Publishing Exchange 2003 Outlook Web Access (OWA) with ISA Server 2000 – Part 3: SSL Bridging Drill Down and Requesting a Web Site Certificate

1. The OWA client sends the request

The connection breaks if the common name on the server certificate doesn’t match the name used by the client request. There are two places where the connection could break in the scenario above:

• If the common name on the certificate used by the ISA Server firewall to impersonate the OWA 2003 site doesn’t match the server name (FQDN) used by the OWA client on the Internet

• If the common name on the certificate on the OWA 2003 Web site doesn’t match the server name (FQDN) used by the Web Proxy service to forward the request to the OWA 2003 Web site on the internal network; the name in the request is determined by how you configure the Web Publishing Rule. We will cover this issue in detail in the next article in this series

Keep these facts in the back of your mind as we work through the certificate request, certificate export, certificate import and finally the Web Publishing Rule. I’ll remind you of these issues when they enter into the equation.

The Web site certificate request Wizard makes requesting a certificate from the enterprise CA easy. This is one of the reasons why we decided to use an enterprise CA. Perform the following steps at the OWA 2003 computer to request and install the Web site certificate:

1. Click Start, point to Administrative Tools and click on Internet Information Services
2. In the Internet Information Services Manager console, expand your server name and then expand the Web Sites node in the left pane of the console. Click on the Default Web Site node and then right click on it. Click the Properties command.
3. In the Default Web Site Properties dialog box, Click on the Directory Security tab. Click on the Server Certificate button in the Secure communications frame.

4. Read the information on the Welcome to the Web Server Certificate Wizard page, then click Next.
5. On the Server Certificate page, select the Create a new certificate option and click Next.

6. On the Delayed or Immediate Request page, select the Send the request immediately to an online certification authority option and click Next.

7. On the Name and Security Settings page, type in a name for the certificate. This is a descriptive name and has no effect on the function of the certificate. Select the Bit length for the encryption key. The longer the bit length, the more secure the connection, but with a performance hit. We’ll select the default 1024 in this example and click Next.

8. On the Organization Information page, type in an Organization name and an Organizational unit name. While these entries are not required, you should enter accurate information in these fields because you might want to use these fields in the future for mapping fields for access control. Click Next.

9. Enter the common name of your site in the Common name text box on the Your Site’s Common Name page. Remember that this common name must be the same name as the Fully Qualified Domain Name (FQDN) that the external users will use to access your site. This is a critical entry because if you do not enter a correct Common Name on the certificate, your OWA publishing rule will not work. In this example we’ll use the common name

The next step is to export the Web site certificate with its private key. The reason for this is the ISA Server firewall needs this certificate so that it can present itself to the world as www.internal.net. The heart of PKI is that only the true owner of a certificate has the private key. However, you can “impersonate” the true owner of the certificate by exporting the certificate along with the private key.

You can choose to remove the private key from the OWA site or leave it in place. You should not remove the private key from the Web site certificate at the OWA site itself, because the Web site still requires access to this key when identifying itself to clients that directly connect to it, or connect to the site via a route other than going through the ISA Server firewall.

Perform the following steps to export the Web site certificate:

1. Click the View Certificate button in the Secure communications frame on the Directory Security tab in the Default Web Site Properties dialog box.
2. Click the Details tab on the Certificate dialog box. In the Details tab, click on the Copy to File button.

3. Read the information on Welcome to the Certificate Export Wizard page and click Next.
4. Select the Yes, export the private key option on the Export Private Key page. This allows the private key to be included with the certificate. YOU MUST SELECT THIS OPTION or else the OWA Web Publishing Rule will not work. Click Next.

5. On the Export File Format page, select the Personal Information Exchange – PKCS #12 (.PFX) option (actually, you don’t have a choice, since the other options are grayed out). Place a checkmark in the Include all certificates in the certification path if possible option. This allows both the Web site certificate and any CA certificate in the hierarchical to be included in the exported file. REMOVE the checkmarks from the Enable strong protection (requires IE 5.0, NT 4.0 SP4 or above) and Delete the private key if the export is successful checkboxes. You must remove those checkmarks or your OWA Web Publishing Rule will not work. Click Next.

6. On the Password page, type in a Password and Confirm password. Its important that you password protect this file because the private key can allow the holder to impersonate your site. If the private key were to fall into the wrong hands, they could impersonate your site and potentially steal value data. Click Next.

7. On the File to Export page, type in a file name and path for the certificate file in the File name text box and click Next.

8. Review your settings in the Completing the Certificate Export Wizard page. Then click Finish.
9. Click OK on the Certificate Export Wizard dialog box.
10. Close the Certificate dialog box. Click OK on the Default Web Site Properties dialog box.

A large amount of private data moves between the OWA Web site and OWA mail clients. You must secure this as it moves over the wire. If the information isn’t secured while “in flight” then anyone with a simple freeware network analyzer (sniffer) could gain virtually complete knowledge of your organization’s activities.

Note that you do not need to force a secure channel. You can still establish an SSL connection with the site when you type https:// in the browser address bar. However, you leave it up to the discretion of the user when you make SSL optional. A good security policy does not leave data encryption decisions to the end user’s discretion.

You need to force SSL on the following OWA directories:

The same procedure applies to each of these virtual Web site directories. Perform the following steps to force authentication on the OWA directories:

1. In the Internet Information Services (IIS) Manager console, expand your server name and then expand the Web Sites node. Expand the Default Web Site node. Click on the Exchange node, then right click on it and click the Properties command.

2. In the Exchange Properties dialog box, click on the Directory Security tab. On the Directory Security tab, click the Edit button in the Secure communications frame.

3. On the Secure Communications page, put a checkmark in the Require secure channel (SSL) and Require 128-bit encryption checkboxes. This forces any host connecting to this directory to use 128-bit SSL. If the client cannot successfully negotiate a 128-bit SSL connection with the directory, then the connection request will fail. Click OK.

4. Click Apply, then click OK in the Exchange Properties dialog box.
5. Repeat steps 1 through 4 with the ExchWeb and Public folders in the Internet Information Services (IIS) Manager console.
6. Right click on the server name in the left pane of the console, point to All Tasks and click on Restart IIS.

7. Confirm that the Restart Internet Services on entry is appears in the What do you want IIS to do? drop down list box. Click OK.

In this article we began by expanding a bit on the SSL bridging process and how the common name on the certificate is a critical setting in the OWA Web Publishing process. We then requested a Web site certificate for the OWA Web site using the Certificate Request Wizard and then exported that certificate with its private key. We finished up by forcing SSL on the OWA directories.

In the next installment of this series on how to publish an Exchange 2003 OWA Web site using ISA Server 2000, we’ll copy the certificate to the ISA Server firewall and import the certificate into the machine’s certificate store. We’ll also import the CA certificate into the Trusted Root Certification Authorities machine store. Once the Web site certificate is installed on the ISA Server firewall, we’ll be able to configure the Web Proxy service’s incoming Web Requests listener to use this certificate. See you then!