Using SSL Certificates with SBS 2003

During a demo of Microsoft Small Business Server 2003 to a client recently, I was demonstrating the Remote Web Workplace (RWW) and Outlook Web Access (OWA) features. These are always a great selling point to anyone who is considering a server solution.

Browsing to https://vpn.ourdomain.com/remote – Internet Explorer naturally flashed up a screen to say “The security certificate presented by this web-site was not issued by a trusted certificate authority” – which is, of course, a correct statement when your server is using a self-signed certificate (as my server was). I clicked Continue, as I always do, and was about to demonstrate the excellent features of RWW when the client asked the question

“Why did that error pop-up?”

My usual response is “It’s nothing to worry about” but it did get me thinking. We are always trying to educate users not to click through warnings, especially on web-sites, without questioning why those warnings are there. The fact my own SBS server gives these warnings isn’t a great demonstration of security! So how to avoid this error?

Asking around a few other SMB Consultants (the smaller outfits and still-learning SMB Consultants like myself, or “Riff Raff” as Vlad refers to us <grin>) on how they would tackle this issue gleaned a variety of answers, none of which were altogether conclusive. So here’s my attempt at explaining how to use SSL certificates with SBS 2003!

First, a crash-course in Trusted Certificates as they are used within SBS 2003. When you visit a secure (https) web-site, your web browser (in this case Internet Explorer) checks the certificate it is presented with by that web-site against a list of Certificate Authorities (CA) it know’s it can trust. Authorities such as Geotrust, Globalsign and Verisign. These are known as “Root Authorities” and are regularly updated by Microsoft.

So when you receive the error “The security certificate presented by this web-site was not issued by a trusted certificate authority” it simply means Internet Explorer cannot verify the certificate it has been presented by the web-site you are visiting as being created by a CA it can trust.

So the simple solution to this problem is – get yourself a Certificate created by a CA that IS trusted by Internet Explorer! Unfortunately, most of the big CA’s charge a small fortune (£100+/year) for such Certificates. For a SMB Consultant rolling out a dozen or more new SBS 2003 solutions per year, that’s going to be a nasty additional cost.

Is there a cheaper alternative? Yes! Get yourself over to www.godaddy.com and buy one of their Turbo SSL Certificates at $34 (about £17) per year. Use the discount code “dl.tv” “YESSSL” for another 10% off a large discount. GoDaddy SSL Certificates are created by ValiCert who are a Trusted Root Authority.

Before you begin to create a new SSL certificate from GoDaddy, you need to do two things

  1. Decide the sites Common Name (i.e. vpn.joebloggs.com) – this is the address that users who are typing in https://<yourcommonname>/rww will use and the address your certificate will become bound to.
  2. Make sure that the Administrative Contact for that domain (i.e. joebloggs.com) has a proper e-mail address that you can access. GoDaddy will send confirmations to this address and you’ll need to respond to it to proceed. You can usually check this information through a WHOIS lookup, or by contacting the ISP you registered the domain with.

When you go through the process of creating your GoDaddy SSL certificate, you’ll be asked to provide a Certificate Signing Request (CSR). This is a chunk of text that tells the SSL provider what to generate within the new Certificate. To create a CSR from your SBS 2003 server:-

  1. On your SBS 2003 server, open Server Management.
  2. Open Advanced Management > Internet Information Services > [your server] > Web-Sites > Default Web-Site.
  3. Right-Click Default Web-Site and select Properties.
  4. Open the Directory Security Tab and select Server Certificate
  5. Click Next and select “Remove the Current Certificate”. Follow the prompts to remove the certificate.
  6. Go back into the Server Certificate option and select “Create a New Certificate”
  7. Select “Prepare the Request Now, but send it later” and click Next.
  8. Enter your Organization name (your Company name) and Organizational Unit. Make sure this is accurate as however unlikely, you may be quizzed on this by the CA later!
  9. Enter the sites common name. It’s very important you get this right! This entry would be your sites externally accessible name (i.e. vpn.joebloggs.com – without the http) and not your servers internal name! Choose carefully here, as if you change your sites name in the future, the certificate you have bought may not work with it post-name change!
  10. Click Next and Fill in the required Geographic Information as required.
  11. Finally, save the request to a file in a location of your choice.

Once the CSR is created, you can open the file within Notepad and copy the information to your clipboard – ready to paste into GoDaddy’s Certificate Generation screen.

GoDaddy will send you a variety of e-mails including an important one to the Administrative contact of the domain you are using. You’ll need to reply to this e-mail to confirm you are the owner of this domain, to enable the Certifcate request to proceed.

Within a few minutes and a few e-mail responses, you should be able to download your new SSL certificate from GoDaddy’s web-site! Save this to your server.

Now we have the certificate, we will need to apply it to your server:-

  1. Open the Server Management console.
  2. Click Internet and E-mail.
  3. Click Connect to the Internet. The Configure E-mail and Internet Connection Wizard starts.
  4. On the Welcome page, click Next.
  5. On the Connection Type page, click Do not change connection type, and then click Next.
  6. On the Firewall page, click Do not change firewall configuration, and then click Next.
  7. On the Web Server Certificate page, click Use a Web server certificate from a trusted authority, click Browse.
  8. You’ll see the type of certificates SBS is looking for are .cer and your GoDaddy certificate may be named something different. In my case, I changed the drop-down list to search for “All Files” and the certificate worked anyway! You may need to use Internet Explorer to import the GoDaddy Certificate and then export it as a .cer file – but try it and see!
  9. Navigate to and double-click the certificate file provided by GoDaddy, and then click Next.
  10. On the Internet E-mail page, click Do not change Internet e-mail configuration, and then click Next.
  11. On the Completing the Configure E-mail and Internet Connection Wizard page, click Finish.

Hopefully we’re all done!

Open Internet Explorer and browse to the external address – i.e. https://vpn.joebloggs.com/remote and with any luck you shouldn’t get any sort of Internet Explorer Certificate warning, and you’ll be good to go! If you’re an SMB Consultant, next time you demo SBS 2003 to a client you won’t have to gloss over any of those error messages!

One thing to remember is that this Certificate verifies the identity of the server externally. If you accessed the server internally – i.e. https://yourserver/remote – you’d still get a warning message that the Certificate doesn’t match the actual server name.

There is a way around this, using a Certificate option known as “Subject Alternative Naming” (SAN). Using this option you can give your Certificate both an internal and external address to use. The catch? Price – you’ll usually find these types of servers are much more expensive.

If you’re still interested in using SAN – go take a look at the options at Globalsign. The company comes highly recommended – it’s owned by my Cousin Steven and he kindly helped me research the various options! 🙂

Another upside of using a 3rd Party Certificate is that if you own a Windows Mobile device with an “always on” Internet connection, you can set it to synchronise with your Exchange Server and also push e-mails from Exchange directly to your device. I’ll document how I set that up next time!

I hope you find the above information useful and it saves you some time drawing together the various snippets of information you’ll find elsewhere on the ‘net. If you’ve got anything to add or any corrections for me, do leave a comment!

 

Richard Tubb is an Independent Consultant who works with IT companies to help them feel in control and grow their businesses. He is also a Microsoft UK Small Business Specialist Partner Area Lead (PAL). You can e-mail him at richard@tubblog.co.uk or connect with him via Twitter and LinkedIn.

Advertisements

15 Responses to “Using SSL Certificates with SBS 2003”


  1. 1 Andy August 23, 2007 at 12:53 pm

    Thanks for this – we were discussing the certificate process at work yesterday. Didn\’t know about the SAN option – thats handy.As for certificates, I used to use network solutions at $100 for a year – about 3 times cheaper than verisign but GoDaddy is about $18 now, or you can get a free ssl from startcom at http://cert.startcom.org/

  2. 2 Nick September 27, 2007 at 1:26 pm

    Hi, would SAN allow us to Use CRM on SBS2003?
     
    At the moment we have a self assigned certificate to allow us to use outllook over http externaly and it works great.
     
    However if we want to use CRM the only way we can seem to get it to work is by using a certificate for servername.local which then breaks outlook over http.
     
    Regards
     
    Nick
     
     
     
     
     

  3. 3 Richard September 27, 2007 at 3:47 pm

    Hi Nick – I\’d be happy to hear from anyone else who has experience working with SAN certificates, but my understanding is that a SAN Certificate can allow you to refer to a web-site as two (or more, depending on the certificate type) locations. So in your case, https://externalwebsite.com and https://servername.local would both be accessible. If you need more advice on CRM, then Julian Sharp at Vigence (http://www.vigence.com) comes recommended.

  4. 4 Rob October 14, 2007 at 12:14 am

    Hi.
    Good info thanks.
     
    If anyone is interested I have internal and external ssl access enabled using the godaddy cheapy cert.
    I just added a reverse DNS lookup for the external domain name to resolve to the internal IP address of the server.
    that way the domain \’domain.com\’ resolves internally and allows the cert to function.
    This also works for OMA through activesync over ssl.

  5. 5 absolutforyou January 22, 2008 at 2:10 pm

    thank for this tips
     

  6. 6 Warrick October 2, 2009 at 3:38 pm

    Thanks very much, your help was much appreciated… @wogsman

  7. 7 Pēteris November 15, 2009 at 8:22 am

    Actually http://www.startssl.com can provide certificates free of charge. Same instructions as above.

  8. 8 Richard November 16, 2009 at 7:11 am

    Pēteris – thanks for the link.I\’m not aware of StartSSL – but we\’ll certainly take a look at it.Anybody else had any experience using this company?

  9. 9 Richard February 17, 2010 at 1:58 pm

    My main man Paul Dadge has mentioned that the code dl.tv no longer works with GoDaddy.However, the code PROMOSSL gives an SSL Certificate for $12.99 as opposed to $29.99 – thanks Dadger! 🙂

  10. 10 Guy May 7, 2010 at 12:01 pm

    If you\’re looking for a UK alternative to GoDaddy, 123-reg now offer SSL certs from £14.99/year.

  11. 11 Richard May 7, 2010 at 3:03 pm

    Guy – thanks for sharing, 123-reg are a good company to deal with!

  12. 12 PlanIT Computing July 1, 2011 at 10:57 pm

    Excellent guide, clear and in depth.


  1. 1 I got “Freshly Pressed”! « TubbBlog Trackback on February 4, 2011 at 8:52 am
  2. 2 Tubblog at 500 – Tips on Blogging Longevity « TubbBlog Trackback on February 28, 2011 at 8:59 am

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s




Archives

Tubblog on Twitter

LinkedIn

Enter your email address to subscribe to Tubblog and receive notifications of new posts by email.

Join 48 other followers

Microsoft Small Business Specialist Logo
Computer Weekly Blog Awards 2010 Logo
MSP Mentor 250 Logo
SMB 150 List Logo
International Association of Microsoft Channel Partners Logo
MyFreeCopyright.com Registered & Protected

%d bloggers like this: