Ask a questionAsk a question
 

QuestionConfiguring SSL for OWA

  • Monday, October 19, 2009 9:58 PMWin HighTechLA Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     

    I am trying to configure SSL for OWA.

    I am able to access my OWA within my network (intranet)
    How ever when I am on another ISP I cannot access the secure website.

    What could be the cause of this? 
    Please help,

    Thank you

All Replies

  • Tuesday, October 20, 2009 12:14 AMmarkmorow Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Are you allowing port 443 to that box from the internet? Are you able to connect on port 80 from the internet?
    Mark Morowczynski|MCT| MCSE 2003:Messaging, Security|MCITP:ES, SA,EA|MCTS:Windows Mobile Admin|Security+|http://almostdailytech.com
  • Wednesday, October 21, 2009 9:30 AMXiu Zhang - MSFTMSFT, ModeratorUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     

    Hi,

    What is the detail error information?

    What is the certificate installed on IIS server,self-signed or 3rd party?

    What is the URL for OWA? https://exchangeserver/owa? Https://domain.com/owa ?

    Have you point the domain name to  your Exchange Server from public DNS?

    Do you have ISA?

    Regards,
    Xiu

  • Tuesday, October 27, 2009 3:53 PMWin HighTechLA Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     

    Yes,


    http://email.domain.com/exhange works fine internally and externally.

    After I grab a server certificate in IIS, and enable "Require secure channel (SSL)" and "Require 128-bit encryption"

    I go to https://email.domain.com/exchange it works fine with the internal users connected in the same ISP.
    but when I switch ISPs outside of the network, OWA does not work.

    So the problem is, external users are unable to connect securely to the exchange server on our internal network.

    Thanks for the replies

  • Wednesday, October 28, 2009 2:26 AMXiu Zhang - MSFTMSFT, ModeratorUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Hi,

    Where is the certificate issue from? Self-signed? From 3rd?

    Regards,
    Xiu
  • Wednesday, October 28, 2009 3:31 PMWin HighTechLA Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     

    Self signed, just the regular CA from windows server 2003.

  • Thursday, October 29, 2009 3:21 AMXiu Zhang - MSFTMSFT, ModeratorUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Then I suspect it could be the certificate related issue.

    Please post the detail error information when you access OWA from Outside.
  • Thursday, October 29, 2009 10:13 PMDeelow Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     

    While we are on the topic of certificate related issues...

    I was wondering if I have a 3rd party wildcard cert with a common name of *.company.com. 
    Will it work on a clustered BE server in another domain, such as mail.contoso.com if this address routes to the BE server?

  • Friday, October 30, 2009 3:33 AMXiu Zhang - MSFTMSFT, ModeratorUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Hi Deelow,

    That could be possible.

    You can get more information from Wayne Phillips's post from the following thread.

    Authentication Modes
    http://social.technet.microsoft.com/Forums/en-US/exchangesvrmobility/thread/6d07bbd3-ea07-4964-b47b-4d0c08c45cce

    Regards,
    Xiu
  • Monday, November 02, 2009 2:18 AMWin HighTechLA Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    It just gives the regular:

    Unable to connect


    Firefox can't establish a connection to the server at email.domain.com.

           

        *   The site could be temporarily unavailable or too busy. Try again in a few
              moments.

        *   If you are unable to load any pages, check your computer's network
              connection.

        *   If your computer or network is protected by a firewall or proxy, make sure
              that Firefox is permitted to access the Web.



    We have Sonicwall here, in which I have already enable all WAN traffic to specifically the internal LAN ip of the exchange server.

    What else could be the problem?

    Thanks.