matt-helm
asked on
SBS2003 OWA SSL Getting Error Code 10061
My situation is as follows...
I have a SBS2003 server and a seperate server running ISA 2004. I followed the guide on isaserver.org to get OWA published with SSL. I'm running on a .local and have added a entry to the host file on the ISA 2004 server pointing mail.domain.com to the internal ip address of the SBS2003 server.
When I try and login to https://mail.mydomain.com/exchange i'm of course getting the CA error which is caused by the .local which is not an issue right now. I'll setup a split DNS later. After I click through the cert error i'm getting:
Error Code 10061: Connection refused
Background: When the gateway or proxy server contacted the upstream (Web) server, the connection was refused. This usually results from trying to connect to a service that is inactive on the upstream server.
ISA 2004 Log:
Destination IP: 192.168.16.2
Destination Port: 443
Protocol: https
Action: Failed Connection Attempt
URL: http://servername.domain.local:443/exhange
Any help would be appreciated!
I have a SBS2003 server and a seperate server running ISA 2004. I followed the guide on isaserver.org to get OWA published with SSL. I'm running on a .local and have added a entry to the host file on the ISA 2004 server pointing mail.domain.com to the internal ip address of the SBS2003 server.
When I try and login to https://mail.mydomain.com/exchange i'm of course getting the CA error which is caused by the .local which is not an issue right now. I'll setup a split DNS later. After I click through the cert error i'm getting:
Error Code 10061: Connection refused
Background: When the gateway or proxy server contacted the upstream (Web) server, the connection was refused. This usually results from trying to connect to a service that is inactive on the upstream server.
ISA 2004 Log:
Destination IP: 192.168.16.2
Destination Port: 443
Protocol: https
Action: Failed Connection Attempt
URL: http://servername.domain.local:443/exhange
Any help would be appreciated!
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
I should state, that using a separate server for ISA in an SBS environment doesn't really make much sense, in both cost and ease of management. Why have you chosen this configuration?
Jeff
TechSoEasy
Jeff
TechSoEasy
What's the FQDN that you entered in your certificate? Also keep in mind that the certificate will do a reverse DNS lookup to verify that it's not being spoofed.
ASKER
Ok.. I did get the cert straightened out and i'm getting the OWA login over Https!
Now the problem is that when I try and login, it's just going back to the login screen.. no errors.
Now the problem is that when I try and login, it's just going back to the login screen.. no errors.
ASKER
Well..the problem was that in my cert I had mail.domain.com in my To: when i redid the cert and had severname.domain.local in the To: it worked. But like i said i'm it's failing some how when I try and log in.
ASKER
https://mail.domain.com/exchweb/bin/auth/owalogon.asp?url=https://mail.domain.com/exchange&reason=0
This is what i'm seeing in address bar once i try and log in..
This is what i'm seeing in address bar once i try and log in..
ASKER
Well.. I got it all fixed!
I needed to turn off Formbased Authentication on the Exchange Virtual Server
Thanks ;)
I needed to turn off Formbased Authentication on the Exchange Virtual Server
Thanks ;)
See, all of that would be done automatically on a standard SBS installation. Which makes me still wonder why you are using a separate ISA Server.
But glad you got it working.
Jeff
TechSoEasy
But glad you got it working.
Jeff
TechSoEasy
ASKER
It makes me nervous having my company firewall sitting on the same server thats holding sensative company information. I was not involved in setting up the network else i would of suggested something a bit more segregated. I also have to set them up with a split DNS solution.
I really don't like SBS2003 to begin with.... Something gets hosed and it can take everything else down with it.
Thanks again.
Helm
I really don't like SBS2003 to begin with.... Something gets hosed and it can take everything else down with it.
Thanks again.
Helm
ASKER
Oh.. one more thing while i have your attention. About the CA error a end user will see when using OWA from the outside. The only way is to buy a cert from verisign or someone else?
I mean they can click through the cert error not being from a trusted source.. but is there anything else i can do?
I mean they can click through the cert error not being from a trusted source.. but is there anything else i can do?
SBS is designed for what MOST small companies need... a solution that is COST EFFECTIVE, and SECURE. If you configure SBS according to it's design parameters, it's plenty secure. If you start trying to second guess it's design and treat it as though it's a stand-alone enterprise server, it's much less secure and you will spend significantly MORE time managing it and your network.
As for your Certificate error? The only thing to avoid it entirely is to use a 3rd party certificate. The other option is that the first time a user sees that warning, they should VIEW the certificate then INSTALL it. Then they won't ever see the warning that the site isn't trusted... because they've now told their computer that it is.
Jeff
TechSoEasy
As for your Certificate error? The only thing to avoid it entirely is to use a 3rd party certificate. The other option is that the first time a user sees that warning, they should VIEW the certificate then INSTALL it. Then they won't ever see the warning that the site isn't trusted... because they've now told their computer that it is.
Jeff
TechSoEasy
ASKER
Error Code: 500 Internal Server Error. The target principal name is incorrect. (-2146893022)
And yes.. I can access the site internally http://servername/exchange