IIS (Internet Information Services)

EnvisionSCADA, using ASP.NET Core, runs on IIS. 

From the website of Microsoft: 
“ASP.NET Core is a cross-platform, high-performance, open-source framework for building modern, cloud-enabled, Internet-connected apps. 
Internet Information Services (IIS) for Windows® Server is a flexible, secure and manageable Web server for hosting anything on the Web. From media streaming to web applications, IIS's scalable and open architecture is ready to handle the most demanding tasks.”

Restart IIS
In case of a severe crash, you can try to restart the computer, or try to restart the service. 
You can restart the service by going into IIS, you will find EnvisionSCADA, and click the Restart button. 

If that doesn’t work, you can try to restart the application pools and click the Stop, wait, then Start button.

Change Port
By default, Envision SCADA will deactivate the Default Web Site in IIS, and put EnvisionSCADA instead on port 80. 

By default, in Windows 11 this port is allowed through the firewall. 

Port 80 is an HTTP connection, so not an HTTPS connection, therefore not encrypted by default.  If you wish to encrypt and secure your network between client and server, you need to add an HTTPS port, and assign the appropriate certificate. 

Click Bindings:

Click the add button and add an https binding on port 443, or any other available port. You now need to choose your private or public certificate.

SSL Certificate

For the https connection to be trusted, you need to assign an SSL certificate. 
A public certificate is necessary if you decide to link EnvisionSCADA to a public domain and make it available on the internet. You need to buy this certificate from a publicly trusted authority.

A private certificate is necessary if EnvisionSCADA runs on your local network, and you wish to secure communication in-between. You need to obtain this certificate from your own private authority. 

If you need help obtaining private certificates, we can help you with this as an additional service. 

SSL certificates fully encrypt any communication between the client and the server. Note that communication between the server and the devices is not encrypted unless you use a secure protocol like OPC UA certificates, or MQTT certificates. You could also use a VPN instead. We can also help you with this as an additional service.

We kindly refer to the following website for more information: https://www.cisa.gov/news-events/news/understanding-website-certificates 

Firewall
Port 80, or 443, or any other port you have set, needs to be allowed as an inbound connection in the firewall of your server or computer. You can do that in the Windows Defender Firewall with Advanced Security:

IIS Settings

Setup configures the items below for every instance. They are listed with the names used in IIS Manager and in Windows Features, so a server can be checked against this list.

The first instance uses the site and app pool EnvisionSCADA, every other instance EnvisionSCADA-<Name>, see Multiple Instances. Taking over an earlier installation keeps its site with all bindings and applies these settings. An update points the site at the new program version and keeps the bindings and the app pool settings. Repair in Maintain EnvisionSCADA puts the settings back and keeps the bindings.

Windows Features
Setup enables these features and the features they depend on. It also installs the ASP.NET Core Hosting Bundle, which adds the ASP.NET Core Module to IIS.

App Pool
In IIS Manager, select the app pool under Application Pools and open Advanced Settings.

Site
In IIS Manager, select the site under Sites. Physical Path, Application Pool, Start Automatically and Preload Enabled are in Advanced Settings, the bindings in Bindings.

ENVISION_DATA_ROOT and ENVISION_INSTANCE are environment variables of the site, stored in applicationHost.config. Configuration Editor shows them in the section system.webServer/aspNetCore, From ApplicationHost.config, collection environmentVariables.

Default Web Site
When setup takes over an earlier installation, or adds an instance on HTTP port 80 without a host name, it stops the Default Web Site and sets its Start Automatically to False.

The data folder of a taken-over installation stays in C:\inetpub\wwwroot, the folder of the Default Web Site. Setup writes a web.config to this data folder that refuses every request, so the data stays closed when the Default Web Site is started again.

web.config
The program folder of each version holds a web.config with these settings. In IIS Manager, the limits are under Request Filtering, Edit Feature Settings. All instances of a version share this file, and the next version brings its own copy.

Data Folder Permissions
Setup removes the inherited permissions of the data folder and sets the permissions below on the folder, its subfolders and its files.

A program folder outside C:\Program Files gets the permissions of C:\Program Files: Full control for SYSTEM and Administrators, Read & execute for Users.