Solved

OWA SSL Security

Posted on 2006-11-21
4
296 Views
Last Modified: 2013-12-04
Hi,

I was researching the setup of OWA with a self created SSL certificate. Before i did anything i forwarded the appropriate ports and attempted to access OWA. It seems to have its own default certificate installed. I was happily able to access my email through https.

The question i have is:

1. Is this default SSL certificate secure.

2. What are the advantages of setting up my own SSL Certificate authority.  As in is there a difference from the defaul certificate ( Im only interested in using it with OWA)

0
Comment
Question by:Danbrasco
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 57

Accepted Solution

by:
Pete Long earned 230 total points
ID: 17986199
SSL and certificates are not set up by default? someone has either set them up - or your running small business server (that does have certificates installed by default)

>>1. Is this default SSL certificate secure.

As secure as any other SSL certificate - essentially all a certificate does is stop data being sent in "cleartext" SSL certificates are as secure from your OWN CA as they are if you got them from verisign or another online CA.

The Real question should be .......................

Are my certificates as TRUSTWORTHY - well if only you and your staff are going to use it then yes  - if you want to offer your OWA to all and sundry out on the internet than they might trust an Ensign or Verisign certificate MORE than yours.

>>2. What are the advantages of setting up my own SSL Certificate authority.

It takes about 5 mins, when your cert expires you can issue a new one straight away - you can use your own CA for doing other things (like securing internal IP traffic digitally signing emails etc etc)
0
 
LVL 13

Assisted Solution

by:hstiles
hstiles earned 20 total points
ID: 18008486
1 other point to make about self-generated certififcates is that by default your clients won't immediately accept them, unless you set up your own internal certififcate authority for use by internal machines.  Every time someone browses to your OWA website, they'll get an SSL warning informing that the certificate is not from a trusted authority.

You can get certificates from an intermediate authority for not a lot of money nowadays.  E.g. www.instantssl.com  These work without problems almost all of the time.
0
 

Author Comment

by:Danbrasco
ID: 18018685
Thank you for your tips.
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 18018822
ThanQ
0

Featured Post

The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
tutorial for ebay api 3 104
PCI-DSS Compliance:  third-party e-commerce embedded code security 5 58
e-commerce site using wordpress 4 49
What cart is this? 2 56
Since pre-biblical times, humans have sought ways to keep secrets, and share the secrets selectively.  This article explores the ways PHP can be used to hide and encrypt information.
Encryption for Business Encryption (https://en.wikipedia.org/wiki/Encryption) ensures the safety of our data when sending emails. In most cases, to read an encrypted email you must enter a secret key that will enable you to decrypt the email. T…
Viewers will get an overview of the benefits and risks of using Bitcoin to accept payments. What Bitcoin is: Legality: Risks: Benefits: Which businesses are best suited?: Other things you should know: How to get started:
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question