Solved

What are the proper security settings in IIS for Exchange and RPC using SSL

Posted on 2007-11-30
10
746 Views
Last Modified: 2012-05-05
I have a clients server that I belive the security settings are all screwed up inside of IIS.
We recently purchased a SSL cert for them and are attempting to setup their Exchange OWA and RPC to use the SSL.  I can't seem to find an article that addresses ALL the settings from use SSL 128 and authentication and access types.
I remember reading a EE posting about this very thing, but cannot seem to find it.
Any help would be appreciated.
Our server is a Win2k3 sp1.
Thanks.
0
Comment
Question by:brian_appliedcpu
  • 5
  • 5
10 Comments
 
LVL 104

Accepted Solution

by:
Sembee earned 500 total points
ID: 20383777
The simplest way to deal with this is to recreate the virtual directories for OWA using this article:
http://support.microsoft.com/default.aspx?kbid=883380

Remove the RPC Proxy component from Add/Remove Windows Components, then delete the RPC and RPCWITHCERT virtual directories from IIS Manager. Run IISRESET in a command prompt and then reinstall the component. You will then need to recreate the registry settings.

No other changes are required. Require SSL and the 128 bit settings are not required to work correctly and should be left alone. The SSL certificate will work correctly without those being set. Many people seem to think that require SSL turns SSL support on and off - it does not. All it does is force the server to generate a warning if the client does not come in on the HTTPS URL.

Simon.
0
 
LVL 2

Author Comment

by:brian_appliedcpu
ID: 20383806
Recreate what registry settings?
the rpc ports?  
0
 
LVL 104

Expert Comment

by:Sembee
ID: 20383909
RPC over HTTPS requires a ton of registry settings to be applied unless you are in a frontend/backend scenario. Those are wiped out when you remove the RPC Proxy component.

Simon.
0
 
LVL 2

Author Comment

by:brian_appliedcpu
ID: 20384211
did the recreate the virtual directories for OWA using this article:
http://support.microsoft.com/default.aspx?kbid=883380
but still having the same 404 issue.
I do not have sharepoint installed.
I do have reporting services installed however.
0
 
LVL 104

Expert Comment

by:Sembee
ID: 20386698
Are you getting a 404 on both http and https?
Is that happening immediately, or do you get any kind of prompt?
Did the directories create correctly on their own?
Any errors in the event logs when the services were restarted?

Anything else installed on this machine that could have taken over the Default Web Site?
Have you checked the configuration of IIS to ensure that there is nothing else listening on the port on that IP address?

Simon.
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 
LVL 2

Author Comment

by:brian_appliedcpu
ID: 20386846
We had sql 2000 reporting services installed and uninstalled them but i dont think that was the issue.
I did the recreate 3 times with no difference then i tried a different account rather than the administrator's and it worked fine.  Now i wonder if it was broken at all.....????
Thanks for your help and i will give you the points because you taught me something about recreating the iis virts.
0
 
LVL 2

Author Comment

by:brian_appliedcpu
ID: 20391011
I lied, i did not wait long enough to see if it finished loading...
Now all it says is that it is Loading the inbox....forever.
0
 
LVL 104

Expert Comment

by:Sembee
ID: 20391393
Microsoft have an extensive article on the "loading" issue:
http://support.microsoft.com/default.aspx?kbid=280823

Simon.
0
 
LVL 2

Author Comment

by:brian_appliedcpu
ID: 20391493
I now understand that i must reinstall exchange so i am in the process and since i have sp2 installed it keeps asking me to overwrite newer file?  Since i will immediately install sp2 should i say yes or no?
0
 
LVL 104

Expert Comment

by:Sembee
ID: 20392004
I tend to say no, and then install the service pack immediately. You must also install any updates that were on the machine that are dated after the service pack, before you look at putting the machine back in to production.

Simon.
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now