Solved

Installation of a UC digital certificate in EBS environment

Posted on 2010-09-20
11
877 Views
Last Modified: 2013-11-10
Dear Experts,

I have just purchased a new cert and want to install it into my EBS environment. Previously we had domainA.com and now we will be using domainB.com.  So we still need domainA.com to feature in our organisation for a year (or so).

So I purchased a UC cert from comodo for the fqdn remote.domainA.com and remote.domainB.com. I have completed the cert request in IIS7 on the management server. I exported it and added to the trusted root authority and personal store on the security server (forefront) then added it to  listener in the rww publishing rule within forefront.

I have made all the necessary DNS changes for MX and A records for the domainB.com

In exchange, I have added domainB.com to the list of accepted domains and changed the recipient policy to make it the default for sending for all users.  I have tested mailflow to and from user@domainB.com and all seems ok.

2 questions:

1. Given the information above, I can still access the rww site by visitng https://remote.domainA.com and all works fine. When I view the certificate presented, it shows me the new one. But when I visit https://remote.domainB.com i get the "The page cannot be displayed " with "Error Code: 403 Forbidden. The server denied the specified Uniform Resource Locator (URL). Contact the server administrator. (12202)"

What gives here?

2. What else have I missed? I'm pretty sure that I have to update and enable the exchange  certificate services.

Bear in mind I have no experience with UC certificates and am treading carefully here...

Many thanks in advance.
0
Comment
Question by:Cruthin
  • 7
  • 3
11 Comments
 
LVL 32

Expert Comment

by:endital1097
ID: 33721422
you need to install the new certificate onto the exchange server
then run the following to locate the cert
get-exchangecertificate | fl

then using the thumbprint for the new cert run
enable-exchangecertificate -thumbprint <id> -services "iis,pop,imap,smtp"

you do not need to restart any services
0
 

Author Comment

by:Cruthin
ID: 33721448
Ok. great.  Will that sort the problem of accessing RWW using the https://remote.domainB.com ?
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33721450
what is the entire http error code 403.x?
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:Cruthin
ID: 33721458
the error displayed in IE8 is:

The page cannot be displayed  
Explanation: There is a problem with the page you are trying to reach and it cannot be displayed.

--------------------------------------------------------------------------------

Try the following:

Refresh page: Search for the page again by clicking the Refresh button. The timeout may have occurred due to Internet congestion.
Check spelling: Check that you typed the Web page address correctly. The address may have been mistyped.
Access from a link: If there is a link to the page you are looking for, try accessing the page from that link.

--------------------------------------------------------------------------------

Technical Information (for support personnel)

Error Code: 403 Forbidden. The server denied the specified Uniform Resource Locator (URL). Contact the server administrator. (12202)
 
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33721474
0
 

Author Comment

by:Cruthin
ID: 33721487
just the same.  I will install the cert on the exchange server tomorrow to see if that fixes the issues and report back.

thanks.
0
 

Author Comment

by:Cruthin
ID: 33723645
I installed the new cert on the exchange server. I ran the enable-exchangecertificate -thumbprint <id> -services "iis,pop,imap,smtp"  command  and all users immediatley received a certificate error message.  So I switched it back.

Any thoughts.
0
 

Author Comment

by:Cruthin
ID: 33724143
I have looked at the forefront logs and found the following entry. I have changed the private names and addresses where applicable:

#################################################################

Denied Connection SECURITYSERVER 21/09/2010 12:06:56
Log type: Web Proxy (Reverse)
Status: 12202 The Forefront TMG denied the specified Uniform Resource Locator (URL).  
Rule: Default rule
Source: External (external IP)
Destination: Local Host (192.168.1.2:443)
Request: GET http://remote.domainB.com/ 
Filter information: Req ID: 228512d6; Compression: client=No, server=No, compress rate=0% decompress rate=0% ; FBA cookie: exists=no, valid=no, updated=no, logged off=no, client type=unknown, user activity=yes
Protocol: https
User: anonymous
 Additional information
Client agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.3...
Object source: (No source information is available.)
Cache info: 0x0
Processing time: 1 MIME type: -

######################################################################

It would appear that ISA is denying access when the name remote.domainB.com is used by the client.

Any further thoughts?
 
0
 
LVL 2

Expert Comment

by:aimcitp
ID: 33729029
When you set up the publishing rule on your ISA, did you import the private key with the certificates?

0
 

Author Comment

by:Cruthin
ID: 33736048
I believe so.  I exported the cert from the management server and imported it into ISA. Then i added it to the listener.
0
 

Accepted Solution

by:
Cruthin earned 0 total points
ID: 33909167
I got this resolved.  Please see the link below:
http://www.experts-exchange.com/Microsoft/Windows_Security/Q_26537328.html

Thanks for your input.
0

Featured Post

The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process describes the steps required to Import and Export data from and to .pst files using Exchange 2010. We can use these steps to export data from a user to a .pst file, import data back to the same or a different user, or even import data t…
This article lists the top 5 free OST to PST Converter Tools. These tools save a lot of time for users when they want to convert OST to PST after their exchange server is no longer available or some other critical issue with exchange server or impor…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question