SSL Certificates

[NewNetworkAdmin]

Hi,

Firstly, this is the first time I have attempted to set up SSL certificates so please forgive any confusion or mis-use of terminology!!

I am trying to set up an SSL certificate that will allow users to connect to our Intranet and Outlook Web Acess sites securely (using HTTPS). I followed the instructions at

http://www.msexchange.org/tutorials/Securing-Exchange-Server-2003-Outlook-Web-Access-Chapter5.html

under the section Enabling SSL on OWA.

I installed the Microsoft Certificate Service and set it up as an Enterprise Root CA. I then created a new certificate using the Certificate Wizard within IIS using the certification authority of servername.domain.com\servername that appeared in the drop-down list for Certification Authorities. This seemed to go ok and I enabled SSL on the default web site in IIS. Sure enough, when I tried to connect using HTTP I got an error that said the connection had to be secure. I tried HTTPS and it said "Page cannot be found".

I created a new MMC console for the Certification Authority and looking at the "Failed Requests" section. It has about 30 failed requests listed (I've probably tried about 30 times now!). The errors read like this:

Denied by Policy Module 0x80094800, The request was for a certificate template that is not supported by the Certificate Services policy: WebServer.

I also tried to submit the certificate request using the IIS web page

http://servername/certsrv

but I got a similar error message:

Your certificate request was denied. 

Your Request Id is 32. The disposition message is "Denied by Policy Module 0x80094800, The request was for a certificate template that is not supported by the Certificate Services policy: WebServer. ". 

Contact your administrator for further information.

I guess that there is something I have not configured properly in the Windows Server 2003 CA configuration but I have no idea what it is. I have searched the Internet for help but cannot find the solution anywhere. If anyone has any ideas where I can find it or what to search for then please point me in the right direction.

Any help greatly received. Thanks in advance.

Andy

 

[ntfsDOTsys]

I tried doing all that too and it gave me headaches. First off even if it did work you would get a certificate error on IE7 because it does not come from a trusted root authority.

I would spring for the $$ and just buy one cheap from

http://www.instantssl.com/.

It is very cheap and works great.

A+, Network+, MCP
========================================>
My first computer was the Atari 400 (heh)

 

[reynolwi]

When you get a certificate you use the fully qualified domain name that you are going to use and it has to match on the SSL certificate otherwise you are going to get errors when a user tries to go to that SSL site. So if when you get your certificate you use as the fqdn mail.domain.com . Most browsers do not trust internal certifiates so its recommended that you get a certificate from a third party like GeoTrust, Thawte, Verisign, GoDaddy, etc since most all browsers trust those certs.

Once you install it any folder under that website will be able to use that SSL certificate. So if you have OWA then you can do

https://mail.domain.com/exchange

and it will work and use the SSL certificate. You will have to get other SSL certificates if you change the name of the server or you add other websites to that and they dont fall under the default website. In IIS when exchange is installed it is normally installed under the Default Web Site, so as long as you put your certificate on that Default Website, exchange and any other folder under the website will be able to access it like OMA, Activesync, RPC over HTTPS.

Wm. Reynolds
RRWDS | TxPSS

http://www.rrwds.com

http://www.txpubsafety.com

- - - - - - - - - - - - -
Network Error:
Hit any user to continue

 

[NewNetworkAdmin]

Thanks for your help...

ntfsDOTsys: I realise that the users would get a message stating that the cetificate is not from a trusted source and I also agree that it would be better to purchase a certificate. However, I would like to get some sort of SSL Certificate up and running allowing the decision to purchase a certificate to be made later.

reynolwi: Thanks for the explanations. I created the certificate using the FQDN that will be used. To be honest, if I can just get a certificate to succesfully create I would be happy at this moment!!

Does anyone know what causes the errors in the original post? More importantly, does anyone know how to get rid of them?!

Thanks

Andy

 

[NewNetworkAdmin]

Thanks for all your help on this. I re-posted this message in the IIS forum as this is probably where it should have gone in the first place!! If anyone's interested in how I fixed this issue (well, got round it anyway), click here: thread41-1328475

Andy