SBS2003 OWA SSL Getting Error Code 10061

My situation is as follows...

I have a SBS2003 server and a seperate server running ISA 2004. I followed the guide on isaserver.org to get OWA published with SSL. I'm running on a .local and have added a entry to the host file on the ISA 2004 server pointing mail.domain.com to the internal ip address of the SBS2003 server.

When I try and login to https://mail.mydomain.com/exchange i'm of course getting the CA error which is caused by the .local which is not an issue right now. I'll setup a split DNS later. After I click through the cert error i'm getting:


Error Code 10061: Connection refused
Background: When the gateway or proxy server contacted the upstream (Web) server, the connection was refused. This usually results from trying to connect to a service that is inactive on the upstream server.

ISA 2004 Log:

Destination IP: 192.168.16.2
Destination Port: 443
Protocol: https
Action: Failed Connection Attempt
URL: http://servername.domain.local:443/exhange 

Any help would be appreciated!
matt-helmAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
Have you run the Configure Email and Internet Connection Wizard (CEICW -- which is linked as Connect to the Internet in the Server Management Console > To-Do List)?

Is the Default Web Site running on the SBS?  Because "Inactive on the upstream server" would indicate that it's not running.

Can you access OWA on the SBS itself? (http://localhost/exchange ?)

FYI, you do not need to set up split DNS to account for your CA error.  If it's a self-signed cert, you'll always get an error unless you install the certificate in the remote machine you're using to access OWA from.  If it's a 3rd party certificate, you should use the CEICW to install it properly... click the "More Information" button in the CEICW's SSL Certificate screen for, of course, More Information.  :-)

Jeff
TechSoEasy

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
matt-helmAuthor Commented:
I can't believe the damn service was not running! Yeah.. so I did start the default website. Not sure how i could over looked that.. thanks! BUT! I'm now getting this error from outside:

Error Code: 500 Internal Server Error. The target principal name is incorrect. (-2146893022)


And yes.. I can access the site internally http://servername/exchange
0
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
I should state, that using a separate server for ISA in an SBS environment doesn't really make much sense, in both cost and ease of management.  Why have you chosen this configuration?

Jeff
TechSoEasy
0
megs28Commented:
What's the FQDN that you entered in your certificate?  Also keep in mind that the certificate will do a reverse DNS lookup to verify that it's not being spoofed.
0
matt-helmAuthor Commented:
Ok.. I did get the cert straightened out and i'm getting the OWA login over Https!

Now the problem is that when I try and login, it's just going back to the login screen.. no errors.

0
matt-helmAuthor Commented:
Well..the problem was that in my cert I had mail.domain.com in my To: when i redid the cert and had severname.domain.local in the To: it worked. But like i said i'm it's failing some how when I try and log in.
0
matt-helmAuthor Commented:
https://mail.domain.com/exchweb/bin/auth/owalogon.asp?url=https://mail.domain.com/exchange&reason=0

This is what i'm seeing in address bar once i try and log in..
0
matt-helmAuthor Commented:
Well.. I got it all fixed!

I needed to turn off Formbased Authentication on the Exchange Virtual Server

Thanks ;)
0
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
See, all of that would be done automatically on a standard SBS installation.  Which makes me still wonder why you are using a separate ISA Server.

But glad you got it working.

Jeff
TechSoEasy
0
matt-helmAuthor Commented:
It makes me nervous having my company firewall sitting on the same server thats holding sensative company information. I was not involved in setting up the network else i would of suggested something a bit more segregated. I also have to set them up with a split DNS solution.

I really don't like SBS2003 to begin with.... Something gets hosed and it can take everything else down with it.

Thanks again.
Helm
0
matt-helmAuthor Commented:
Oh.. one more thing while i have your attention. About the CA error a end user will see when using OWA from the outside. The only way is to buy a cert from verisign or someone else?

I mean they can click through the cert error not being from a trusted source.. but is there anything else i can do?
0
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
SBS is designed for what MOST small companies need... a solution that is COST EFFECTIVE, and SECURE.  If you configure SBS according to it's design parameters, it's plenty secure.  If you start trying to second guess it's design and treat it as though it's a stand-alone enterprise server, it's much less secure and you will spend significantly MORE time managing it and your network.

As for your Certificate error?  The only thing to avoid it entirely is to use a 3rd party certificate.  The other option is that the first time a user sees that warning, they should VIEW the certificate then INSTALL it.  Then they won't ever see the warning that the site isn't trusted... because they've now told their computer that it is.

Jeff
TechSoEasy
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server OS

From novice to tech pro — start learning today.