Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote -1 down vote favorite

I have configured a Windows 2003 server to allow SSL access from the Internet, particularly to enable so called Outlook Web Access, that is browse Exchange Server data from the Internet.

Following steps from this site, I have achieved the goal creating a self issued certificate with built in W2K3 Certification Authority, FOLLOWING THE ADVICE to use THE SAME cname as the URL used to access the server from the Internet, that is the cname has been set to 'mydomain.com/exchange' because this is the URL used to access Exchange Server data from the Internet.

Users are allowed to connect however they're facing the tedious untrusted certificate error. I have read a lot about this problem. It looks like this happens when: - the cname and the URL are not the same - the certificate has been issued by an untrusted certification authorithy

To bypass this problem I have tried to force to workstations accessing the website to accept the certificate although not being issued from a well known certification authorithy, but the problem is still there.

What can i try?

EDIT:

Although a warning is issued, navigation is allowed. These are the warnings I get:

Google Chrome:

The site's security certificate is not trusted You attempted to reach mydomain.com, but the server presented a certificate issued by an entity that is not trusted by your computer's operating system. This may mean that the server has generated its own security credentials, which Google Chrome cannot rely on for identity information, or an attacker may be trying to intercept your communications. (Proceed Anyway)

Internet Explorer 9:

*There is a problem with this website's security certificate The security certificate presented by this website was not issued by a trusted certificate authority.

Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server. * (Continue to this website (not recommended). )

Opera 11:

The server's certificate chain is incomplete, and the signers are note registered. Accept? Certificate errors: The certificate for "mydomain.com/exchange/" is signed by the unknown Certificate Authority "WIN2003DC". It is not possible to verify that this is a valid certificate"

share|improve this question
Please show us an example of the certificate error. – Randolph West Apr 26 '12 at 22:33
@Randolph, see my message edit – Riccardo Apr 27 '12 at 5:48
It looks like the self generated certificate is not accepted because the it is not recognized as a valid authority. This is nonsense, why did Microsoft enable the Certification Authority utility in Windows 2003 Server to issue self signed certificates if the authority will not be trusted? – Riccardo Apr 27 '12 at 6:30
I gave up solving the problem on the server side and have tried to install the certificate into the client computer, placing it into the Trusted Authority Store, but the problem is still there. Why so complicated? – Riccardo Apr 27 '12 at 7:27
Well you've answered your own question, really. It's self-generated and Google can see this. There's no point in having SSL if it can't be trusted, and there's no point in accepting a certificate if it was generated on the server you're connecting to. Think about it. – Randolph West Apr 27 '12 at 18:05
show 3 more comments

1 Answer

up vote 1 down vote

If the server and the workstations are all members of the same Windows domain, you can create a Windows certificate authority for the domain and have it issue a certificate to the web server. The CA's root certificate will automatically be published in Active Directory and all computers that are part of the domain will trust that root certificate and any certificates issued by it. This allows your organization to issue its own certificates that are trusted by its own computers without having to pay some third party certificate authority. These certificates are obviously only trusted within your organization.

If you don't have a domain or if the client computers are not part of your domain, than you need a certificate issued by a mutually trusted third party certificate authority. You'll have to pay them for the certificate.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.