Problem installing an SSL certificate on ISA server from local CA

[lesj1968]

Hi

I have an ISA server and 3 internal web servers. My plan is to enable secure SSL access to our network for outside staff. It is not for public use and as such have not needed to purchase a commercial SSL certificate - instead I set up a local CA to issue the certificates. I have set up one of the three internal web servers as the local CA (certification authority). The internal web server acting as the local CA is called "dome.domain.com" (this will be the "common name"). This all worked fine. On the other two internal web servers I typed in the local CA ip address in the web browser followed by "/certsrv" and requested and installed SSL certificates on both machines with no problems at all. In the IIS on each internal web server I had to go to the Directory Security and click "Server Certificate". This took me through the final set up of the certificate on the two internal web servers and on each I ensured the common name as set as "dome.domain.com".

My problem is I now need to install a certificate on the ISA machine. However as the ISA machine cannot access the internet due to its set up (the default gateway is left blank) and also it does not have IIS (which is also normal). However as a result I cannot type in the local CA ip address in the web browswer followed by "/certsrv" in order to request a certificate.

Am I correct in assuming I need to install a certificate on the ISA machine? I assume I do as all access from the outside comes directly through the ISA machine before reaching the internal network. And I assume I need HTTPS to HTTPS bridging to make it more secure and therefore need a certificate installed on the ISA machine AND the internal web server machines that are involved in outside access.

Please can anyone help me resolve this problem? Do I need to import a certificate somehow? If so would this not then remove the certificate from that machine that I am importing from?

Thank you very much for any help.

Les

 

[coco10]

hi, check this.

http://isaserver.org/articles/exportsslcert.html

coco10

 

[lesj1968]

Thank you for your reply. I have successfully imported a certificate from one of the internal web servers. Everything seems to work fine. However the only remaining problem I need to resolve is the fact that a message appears on the external client saying "The CA certificate is not trusted. To enable trust install this certificate in the Trusted Root Certification Authorities Store." I am going to see if I can find information on what this means. Would you know what I have to do to stop this message appearing - or is the message completely normal because we are using a local CA as opposed to a commercial CA?

One thing that is very important: is there any way for me to verify what level of security my certificates are, i.e 128bit etc? Or are they all 128bit?

Many thanks.

 

[coco10]

first the message its normal because the CA ar not public, its only internal you can add this CA in every client but i dont think worth the time to do it. Your certificate ar 128 if you use IIS6. If you want to confirm that when the message appers click in view certificate and then in details search for public key and then may say (rsa 1024 bits)

hope its helps
coco10

 

[lesj1968]

Excellent thank you. It is rsa 1024 - so therefore 128bit.

 

[coco10]

from a practical view yes.

coco10