Unable to map https WebDAV share on Win10

[Scruffy90]

I've been having difficulties mapping my WebDAV share using https on Windows 10 1709 and the latest version. I get a multitude of errors regardless of what I use, the GUI in explorer or the command line. 

 

The odd thing is, it works on all of my other non-windows devices.

 

What else can I try?

 

I've tried:

• net use w: https://{ddns address}:{port}/{share name} /user:{username} * 

  in command prompt
• Map Network drive in explorer
• Add Network location
• Cyberduck
• Adjustments in Internet options for IE and adjusting things in the registry.

[Tabs]

27 minutes ago, Scruffy90 said:

I've been having difficulties mapping my WebDAV share using https on Windows 10 1709 and the latest version. I get a multitude of errors regardless of what I use, the GUI in explorer or the command line. 

 

The odd thing is, it works on all of my other non-windows devices.

 

What else can I try?

 

I've tried:

• 
  net use w: https://{ddns address}:{port}/{share name} /user:{username} * 

  in command prompt
• Map Network drive in explorer
• Add Network location
• Cyberduck
• Adjustments in Internet options for IE and adjusting things in the registry.

 

I just spent the last 20 minutes trying to get some useful information for you on this, but I couldn't reproduce it on 1803. Most of the information I can see online about similar issues relate to TLS 1.1/1/2 support, which was fixed in all public versions of Windows 10 and was backported to Windows 7 and Windows 8/8.1.

 

Has the share worked on previous versions of Windows 10, or has it ever worked on any version of Windows? 

[Tabs]

@Scruffy90

 

Just had a thought - have you ensured that the WebClient service is running on your machine?

[Scruffy90]

6 minutes ago, Tabs said:

 

I just spent the last 20 minutes trying to get some useful information for you on this, but I couldn't reproduce it on 1803. Most of the information I can see online about similar issues relate to TLS 1.1/1/2 support, which was fixed in all public versions of Windows 10 and was backported to Windows 7 and Windows 8/8.1.

 

Has the share worked on previous versions of Windows 10, or has it ever worked on any version of Windows? 

 

2 minutes ago, Tabs said:

@Scruffy90

 

Just had a thought - have you ensured that the WebClient service is running on your machine?

To be honest, this is the first time that I am trying to map a WebDAV share on Windows, as I realized it provides one small benefit for me over my current set up, which is VPNing into my network and mapping the drives normally. From what i've been reading, it worked well in Windows 7. Seen a bunch of complaints regarding Win 8.1 and 10. 

 

I also turned on WebClient Services. Set to automatic now.

[Tabs]

5 minutes ago, Scruffy90 said:

 

To be honest, this is the first time that I am trying to map a WebDAV share on Windows, as I realized it provides one small benefit for me over my current set up, which is VPNing into my network and mapping the drives normally. From what i've been reading, it worked well in Windows 7. Seen a bunch of complaints regarding Win 8.1 and 10. 

 

I also turned on WebClient Services. Set to automatic now.

Out of curiosity, your original post mentions that you're using a DDNS address; is it the same series of errors if you use the IP instead?

 

Edit: also, it's a bit of a silly question, but you mentioned VPN working but WebDAV not; have you ensured that your server is set to accept WebDAV connections directly rather than through the VPN? Are your firewall rules configured?

 

I'm assuming this is all fine if non-windows machines can access the WebDAV share directly, but with you mentioning a VPN I wanted to check and make sure.

Edited July 26, 2018 by Tabs

[Scruffy90]

11 minutes ago, Tabs said:

Out of curiosity, your original post mentions that you're using a DDNS address; is it the same series of errors if you use the IP instead?

 

Edit: also, it's a bit of a silly question, but you mentioned VPN working but WebDAV not; have you ensured that your server is set to accept WebDAV connections directly rather than through the VPN? Are your firewall rules configured?

 

I'm assuming this is all fine if non-windows machines can access the WebDAV share directly, but with you mentioning a VPN I wanted to check and make sure.

Havent tried it using my IP directly. This is something I'll try when I get a chance. Assuming I get the same series of errors, what would that mean?

 

Everything is configured and working well. Oddly enough, Windows 10 allows me to map the WebDAV share through http. 

 

As far as testing it directly and ensuring I wasn't on VPN, its one thing I had to retest to make sure I wasn't going crazy. I was able to confirm this through my phones file browser, while remote and not connected to vpn. I was able to connect to my WebDAV share via https with no issues. 

I honestly Wonder why Windows 10 is giving me a hard time with https specifically.

[Tabs]

2 minutes ago, Scruffy90 said:

Havent tried it using my IP directly. This is something I'll try when I get a chance. Assuming I get the same series of errors, what would that mean?

 

Everything is configured and working well. Oddly enough, Windows 10 allows me to map the WebDAV share through http. 

 

As far as testing it directly and ensuring I wasn't on VPN, its one thing I had to retest to make sure I wasn't going crazy. I was able to confirm this through my phones file browser, while remote and not connected to vpn. I was able to connect to my WebDAV share via https with no issues. 

I honestly Wonder why Windows 10 is giving me a hard time with https specifically.

The IP thing was just me trying to rule out outside variables to be honest - I considered that it might be Windows not liking the dynamic dns provider for some reason. I've certainly had problems with DDNS in the past. If it works via IP, then it's a partial workaround, and if not, we can look into it further.

 

As you mentioned that it works via http, it's worth finding out when connecting via HTTPS on your phone (or your other devices) what specific protocol it's using - Windows no longer has SSL2 support enabled by default (it's insecure), and most configurations also disable SSL3. If your WebDAV server doesn't at least support TLS1.1 (1.0 can potentially be downgraded to SSL3, so in many cases TLS 1.0 connections are considered unsafe) Windows won't connect to it via a secure channel. That's something you will be able to configure at your end on your WebDAV host platform. 

 

Unless I come up with some other ideas, you might need to do some low level hunting using Wireshark analysis - find out if the server or the client is rejecting the connection, and what the reason is. It could simply be mismatched cipher suites, which is fine and can be corrected by reordering them (on either end), or it could be something else entirely. Unfortunately I can't really help with that analysis though, since it would expose a lot of very sensitive authentication information about your WebDAV server.

[Scruffy90]

37 minutes ago, Tabs said:

The IP thing was just me trying to rule out outside variables to be honest - I considered that it might be Windows not liking the dynamic dns provider for some reason. I've certainly had problems with DDNS in the past. If it works via IP, then it's a partial workaround, and if not, we can look into it further.

 

As you mentioned that it works via http, it's worth finding out when connecting via HTTPS on your phone (or your other devices) what specific protocol it's using - Windows no longer has SSL2 support enabled by default (it's insecure), and most configurations also disable SSL3. If your WebDAV server doesn't at least support TLS1.1 (1.0 can potentially be downgraded to SSL3, so in many cases TLS 1.0 connections are considered unsafe) Windows won't connect to it via a secure channel. That's something you will be able to configure at your end on your WebDAV host platform. 

 

Unless I come up with some other ideas, you might need to do some low level hunting using Wireshark analysis - find out if the server or the client is rejecting the connection, and what the reason is. It could simply be mismatched cipher suites, which is fine and can be corrected by reordering them (on either end), or it could be something else entirely. Unfortunately I can't really help with that analysis though, since it would expose a lot of very sensitive authentication information about your WebDAV server.

Using an ip to map the WebDAV share is a no go as well. I'm getting the same errors I was getting before alone with this one :

"System error 1244 has occurred. The operation being requested was not performed because the user has not been authenticated."

 

Long term the IP may not work. I just noticed that I have a dynamic IP. It changed on me as I was trying this out. 

 

I also decided to take a look at the NAS' (which I'm using to access shares via WebDAV) support page to see what protocol it was using, since it's not configurable via the GUI, and there is a note that says "https (SSL) is not supported on Windows 10," with a link to a knowledge base post that suggest using a different WebDAV client that supports older SSL/TLS versions. 

 

Now i'm wondering if its worth continuing to try this method; just fall back on http, which may not be the wisest choice, but works; or test our SFTP.

[Tabs]

2 minutes ago, Scruffy90 said:

Using an ip to map the WebDAV share is a no go as well. I'm getting the same errors I was getting before alone with this one :

"System error 1244 has occurred. The operation being requested was not performed because the user has not been authenticated."

 

Long term the IP may not work. I just noticed that I have a dynamic IP. It changed on me as I was trying this out. 

 

I also decided to take a look at the NAS' (which I'm using to access shares via WebDAV) support page to see what protocol it was using, since it's not configurable via the GUI, and there is a note that says "https (SSL) is not supported on Windows 10," with a link to a knowledge base post that suggest using a different WebDAV client that supports older SSL/TLS versions. 

 

Now i'm wondering if its worth continuing to try this method; just fall back on http, which may not be the wisest choice, but works; or test our SFTP.

The likelihood then is that it's using SSL3 or possibly SSL2, which is far worse.

 

The thing is, SSL2 is so broken that it's no more secure than using http - so if that's your only choice, and you need secure communications, you may have no choice but to find alternatives like SFTP, or continue using a VPN (which is clunky, but ensures all traffic is tunnelled).

 

I'm sorry there wasn't a better answer; you *can* force Windows to use older SSL protocols, but it makes your machine vulnerable to a huge variety of potential man in the middle attacks - it's why this was disabled by default in the first place.

 

The main thing to take away from this though is that the https version of your WebDAV server is no more secure than http because of the old protocol it uses.

[Scruffy90]

6 minutes ago, Tabs said:

The likelihood then is that it's using SSL3 or possibly SSL2, which is far worse.

 

The thing is, SSL2 is so broken that it's no more secure than using http - so if that's your only choice, and you need secure communications, you may have no choice but to find alternatives like SFTP, or continue using a VPN (which is clunky, but ensures all traffic is tunnelled).

 

I'm sorry there wasn't a better answer; you *can* force Windows to use older SSL protocols, but it makes your machine vulnerable to a huge variety of potential man in the middle attacks - it's why this was disabled by default in the first place.

 

The main thing to take away from this though is that the https version of your WebDAV server is no more secure than http because of the old protocol it uses.

Thanks for the help and taking the time to help me narrow this down.