ISA Server 2006 v OWA Exchange 2003

[techies-support]

We have recently set up exchange 2003. We have bought a certificate from comodo and loaded onto ISA server and exchange server. the cerificate is mail.school.net. The domain the school is on is school.county.sch.uk. When setting up the rule in the ISA server within the "to" tab i have read that it must be the same as the certificate i.e mail.school.net. Within the network this isnt recognised and i cannot put a DNS entry for the excahnge server because DNS adds to the end of the record. Any ideas how to get round this? OWA works internally via servername/exchange

[timzim]

Explain more: is school.net registered externally to you or is it just an internal name?

[techies-support]

Thanks maybe i am not clear. The external URL set up on public DNS is mail.school.net. The internal domain is school.county.sch.uk. I have read that the certificate ie mail.school.net. should go in the "to" option. But it isnt recognised internally?

[timzim]

You need a certificate which has the internal name of the mail server which you then shove on the listener on the ISA server (if you've installed Certificate Services on your domain then you can generate it yourself - your users will get a security message but you can tell them to ignore it as the certificate is safe).

[Ric_]

You need a certificate which has the internal name of the mail server which you then shove on the listener on the ISA server (if you've installed Certificate Services on your domain then you can generate it yourself - your users will get a security message but you can tell them to ignore it as the certificate is safe).

 

It's well worth setting up certificate services... make sure you read up on it first! Certificates come in handy when you want to use SCCM, OCS and other funky stuff!

 

Once you have set up certificate services, you can install the certificate of your CA on all your machines via a GPO and then all your machines will be trusted implicitely.

[timzim]

Once you have set up certificate services, you can install the certificate of your CA on all your machines via a GPO and then all your machines will be trusted implicitely.

 

Like Ric says, although your home users will still get a message about invalid certificates (I presume most of your OWA users are not using domain computers) unless you get them to install the CA certificate on their home computer too. Alternatively, since you seem happy to pay for your certificates, buy a commercial certificate for your root CA then all your self-issued certificates will be trusted by everyone (and will be free!).