1st post - help with exchange OWA

Tuffers · 12 Aug 2008 at 13:57

hello i am really hoping someone can help me.

We have set up exchange but currently owa is accessed by typing http://mail.mydomain.com from a browser page.

I wanted to make it https so I set about following some guides and installed certificate components on the server with the CA being mail.mydomain.com. Then used all the defaults like port 443 and all that.

I opened port 443 on the router too.

Went in to iis and directory security. Added the certificate and set it to require encryption.

Now, if I access http://mail.mydomain.com on the server or client I get the page saying I need to try https://

Here is the odd bit. If I am on the exchange server and open IE. If I put https://mail.mydomain.com I get a warning saying "There is a problem with this website's security certificate, The security certificate presented by this website was issued for a different website's address."

If I choose to proceed (not recommended) I get the forms based login and I can access the mail but the address bar is always in red as its moaning about the certificate.

However, if I try the exact same thing from a client by typing https://mail.mydomain.com I get the "Internet Explorer cannot display the webpage"

I cant work out what I have done wrong. Why would the server kind of work but none of the clients do?

Also, if i turn off forms based authentication the server still does the same certificate thing but if I log in it tells me access is denied. But I think that is a seperate issue.

oddjob62 · 12 Aug 2008 at 15:07

The path you type into the address bar must match the common name on the certificate. Is this so?

Tuffers · 12 Aug 2008 at 15:17

yes i beleive so. I set up the common name as mail.mydomain.com and this is the same as what I would type in to the address bar.

Why would it kind of work on the server but not from a client? Does it sound like a permissions thing?

oddjob62 · 12 Aug 2008 at 15:23

Did you say http works fine from client to server?

GarethDW · 12 Aug 2008 at 15:43

Claimed

Welcome to OcUK.... now get me a cuppa tea.

Tuffers · 12 Aug 2008 at 15:43

Yeah. If I turn everything back to HTTP, OWA works fine from both server and client internal and FQDN

oddjob62 · 12 Aug 2008 at 16:51

Can the client PCs connect to other HTTPs sites ok?

Tuffers · 12 Aug 2008 at 17:00

Yes no problems there if you mean general https sites. We dont have any other https sites hosted from the same server

oddjob62 · 12 Aug 2008 at 20:58

Tuffers said:
Yes no problems there if you mean general https sites. We dont have any other https sites hosted from the same server

Yes i did mean general sites.

Windows firewall enabled on the server? (running out of ideas now)

Uhtred · 12 Aug 2008 at 21:57

Are you running a CA?

Uhtred · 12 Aug 2008 at 22:03

Can't edit for some reason...

Also are you testing this externally or internally?

Tuffers · 12 Aug 2008 at 22:08

Hi, my last post seem to disapear.

It was being tested internally. I've tried to access it from home and it works. Well, I still get the certificate error.

Any idea how I resolve that?

Uhtred · 12 Aug 2008 at 22:27

Humm that shouldn't be there when you're working externally. Can you check the common name on the cert?

Tuffers · 12 Aug 2008 at 23:00

common name on cert seems to be the same as mail.mydomain.com

One thing though. In IIS if I choose the server certificate option and say then choose replace, there is a whole list of certificates in there made obviously by me in a manner of different ways with todays date. I'd like to start from scratch, how can I remove them from this list?

oddjob62 · 13 Aug 2008 at 11:17

Tuffers said:
I'd like to start from scratch, how can I remove them from this list?

Add the Certificates mmc snap-in.

EDIT: Are you sure the certs aren't working simply because they are not from a trusted CA? I assume you're creating self signed certs.

Tuffers · 13 Aug 2008 at 14:45

oddjob62 said:
Add the Certificates mmc snap-in.

EDIT: Are you sure the certs aren't working simply because they are not from a trusted CA? I assume you're creating self signed certs.

i wondered that but I have a warning say the cert is not for the site and that it is not from a trusted CA.

If I click the cert error and try and install the cert it says its imported OK but when I close IE and then restart the same issue appears. I can still access the site though but I'd like to try and sort it properly

oddjob62 · 13 Aug 2008 at 16:03

Tuffers said:
i wondered that but I have a warning say the cert is not for the site and that it is not from a trusted CA.

So the warning message does say that it's "Not from a trusted CA"? correct? That would happen with a self signed cert. I can't remember what the CA gets set at with a self signed cert, but if this is not trusted by the client you will get the error.