Home > Ask the Microsoft Exchange Experts > Richard Luckett: Spam and Security Questions & Answers > Setting up an SSL certificate for OWA without a public IP address
Ask The Exchange Expert: Questions & Answers
EMAIL THIS

Setting up an SSL certificate for OWA without a public IP address

Richard Luckett EXPERT RESPONSE FROM: Richard Luckett

Pose a Question
Other Exchange Categories
Meet all Exchange Experts
Become an Expert for this site


Exchange Server tips, tutorials and expert advice
Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google


>
QUESTION POSED ON: 31 August 2006
We want to set up a Secure Sockets Layer (SSL) certificate for Outlook Web Access (OWA), and we do not have a public IP address assigned for our firewall. Can we use Dynamic Domain Name System (DDNS) to allow external access to our Exchange server? Or, will we need a fixed public address to get this to work? I have set up the certificate and OWA works internally, but not externally.


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google


RELATED CONTENT
Outlook Web Access
Troubleshoot 'System Attendant' error messages in OWA
Troubleshoot Microsoft Outlook Web Access problems
Detecting update rollup and patch failures in OWA
Troubleshoot IIS metabase corruption in Outlook Web Access
Fix 'Service unavailable' errors and other common OWA login problems
Troubleshooting Microsoft Outlook Web Access logon issues
Tools to report on Outlook Mobile Access usage
Outlook Web Access issues after an Exchange 2003 migration
Top 5 Outlook Web Access (OWA) tips of 2008
Troubleshooting Outlook Web Access issues on a 64-bit system

User Authentication for Microsoft Outlook and OWA
Top 5 Outlook Web Access (OWA) tips of 2008
Manage user rights and access to Outlook Web Access (OWA) mailboxes
Create a secure Microsoft Outlook Web Access (OWA) redirect page
Why does a security alert pop up when accessing Outlook Web Access?
OWA won't load after applying Exchange 2007 SP1 security patch
Minimize remote and mobile Outlook Web Access (OWA) security risks
How to improve Outlook Web Access (OWA) security
Alleviate Outlook Web Access (OWA) email attachment security issues
How to customize OWA authentication logon in Exchange Server 2003
Automated redirects to OWA directories may fail when SSL is enforced

Richard Luckett: Spam and Security
How effective is tracking the IP address of an email hacker?
Why can't I grant users permissions to an Exchange public folder?
How can I configure Exchange IMF to allow an IP address or DNS?
Tool helps identify inbound Exchange Server email flow issues
Configure SMTP relay restrictions in Exchange Server 2003 to stop spam
How to lock down an SMTP relay to prevent spam in Exchange Server 2003
Connecting an Apple iPhone to Exchange Server on Windows SBS 2003
Why does a security alert pop up when accessing Outlook Web Access?
Exchange email sent to a domain using SPF authentication is returned
Selectively set email permissions for Exchange groups

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
Vouch by Reference (VBR)  (SearchExchange.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary


VIEW MEMBER FEEDBACK TO THIS ASK THE EXPERT Q&A.

It is possible to use DDNS. However, the certificate's common name must match the fully qualified domain name (FQDN) you use with DDNS. Using the IP address will not work unless the common name of the certificate is the IP address.

By the way, there are varying degrees of the word "works" when it comes to Web server certificates. The first level is to establish an SSL session. The next level is to get it to work without any certificate errors. The most common error is that you are not using a "Trusted CA." If this is the error you are getting, then you can simply publish the Root Certificate so that users can import it into their Web browser's trust list. If these are Active Directory (AD) members, I would recommend using a Group Policy Object (GPO) to perform this task.

MEMBER FEEDBACK TO THIS ASK THE EXPERT Q&A:

Depending on your purpose, there is a way to possibly accomplish this. I support Windows Small Business Server (SBS). Several clients have Windows Mobile phones that "require" a Root level certificate, but self-signed certificates created by SBS are not Root level.
—Kevin K.

Do you have comments on this Ask the Expert Q&A? Let us know.

Related information from SearchExchange.com:

  • Expert Advice: How enabling SSL for OWA affects bandwidth
  • Expert Advice: Securing a front-end certificate server
  • Tutorial: How to set up a front-end Exchange Server cluster
  • Tip: ActiveSync and front-end DNS aliases
  • Reference Center: Exchange Server authentication resources



  • Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice



    Outlook Web Access (OWA) Tips and Advice
    HomeNewsTopicsITKnowledge ExchangeTipsAsk the ExpertsMultimediaWhite PapersIT Downloads
    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    SEARCH 
    TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Site Map




    All Rights Reserved, Copyright 2004 - 2009, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts