Having an issue trying to get any client PC to accept the self signed cert provided by sbs 2008... (External clients for RPC over HTTP)

Tried various things, the machines just wont accept them, they are there in the Certs MMC under trusted auth/local machine, but are not present in the certs in the content tab in IE...

Anybody had this?

Ive done a fair bit of fault finding, will post what i have done so far if needed if no one can think of anything quick....

Many thanks

Brett

Hi All...

 

I will try to explain what is going wrong, and what i have tried to do to fix it...

 

setup DNS A record for remote.mydomain.co.uk

 

SBS 2008 created self cert for above FQDN

 

Client machine internal in office (Win XP SP2) prompts for certificate when browsing to https://server/remote, but not https://remote.mydomain.co.uk which is wierd. The cert was installed from \\server\public\downloads and also tried installing from web browser when it wouldnt work locally.

 

Our main issue is the remote clients (Vista Machines)we tried. All still prompt for certificate, none will accept its installed.

 

Here is the path we took to try to solve the issue:

 

1) Installed the self signed cert the standard way by installing it from the browser (Accepted the defaults)

2) Installed cert using browser but forced cert into trusted route cert auth

3) installed cert using browser but forced cert into trusted route cert auth (Local machine)

4) Checked in Cetrs MMC, Cert is in the listing within the MMC in the local machine 7 Local user under trusted route cert auth

5) checked in IE7 -Content/Certs -  the certificate is NOT listed on that tab, nor in any other tab with IE7

6) rechecked in the certs MMC, the cert is still there

7) Installed the cert from the server \\server\public\downloads, still prompting!

 

having looked at the certs there seem to be 2...

 

1 for remote.mydomain.co.uk that when looked at in the certs MMC has an error and cant be verified so it says and 1 for MYSERVER-SERVER-CA relating to the server itself that seems fine....

 

Ive referenced: http://blogs.technet.com/sbs/archive/2008/05/08/installing-a-self-signed-certificate-as-a-trusted-root-ca-in-windows-vista.aspx

and also http://support.microsoft.com/default.aspx?scid=kb;EN-US;932156 but still it wont work...

 

Ive also tried installing the certs running IE7 as admin...

 

Anyhelp..

 

Brett 

Site is listed in IE fine, viewed the cert, reports correct FQDN..

My Mac is having the same issue, throws up error saying the cert is from an unknown authority... stays in the certs folder for about 6 hours then reverts back to telling me its got no cert installed...

Windows machines also report the cert is from an unknown source and cannot be validated..?!?!?!?

Brett

ive tried everything i can, checked everything... Both the Mac and Vista and XP browsers are saying the cert is not from a trusted source and cannot be verified, so prompts every time...

Ive looked at getting a proper SSL cert, there are lots of different ones available, what type is required for SBS 2008 to work correctly?

Ive looked on www.instantssl.com, which is the one i require?

many thanks

Brett

I have just noticed there is a similar post in the SBS2008/exchange2007 sub heading, seems a few people are having this issue...

Seems having a real SSL Cert is the way to go anyway, they are not that expensive these days...

im going to hope that the RTM version of SBS2008 fixes this issue....

Thanks

Brett

Brett -

 

So is the core issue that you're getting prompted about the cert when you attempt to access the internal domain name? If so, don't worry about it and just use the public domain name instead. 

 

SBS 2008 has changed the way they handle internal/external domain names, and it's a huge step inthe correct direction. In the SBS 2003 days, if you tried to access the server using the public domain name from an internal workstation, you could likely run into problems if you were running ISA and/or a business-class firewall at the Internet gateway. SBS 2008 changes that by actually creating an internal DNS record for the public DNS name (i.e., remote.mydomain.co.uk) that resolves to the internal IP address of the server. This way you can simply have all users use the public domain name to access web resources on the SBS server instead of trying to get them to remember one URL for inside and another for outside.

 

There could still be a problem with the way the cert is performing, and if so, that's something we need to look at, but I'm not going to be losing much sleep over it because I'll be instructing the users at client sites I set up on SBS 2008 to learn the public URL and use that everywhere.

 

HTH...

 

-Eriq

Eric,

 

Client machines internal have no issues conecting to the RWW or OWA. Internal clients can view the cert, install it and happily go about there business. The cert has the correct information.

 

External clients get red cross through the cert when viewed, I have attached an image of the cert with the error shown.

 

I have not altered anything in SBS, the cert "is as" and was produced by SBS on setup....

 

Anyhelp on this would be great... the SBS 2003 self cert worked fine BTW on our old system...

 

Thanks

 

Brett

for some reason it did not attach.. Let me know if you want the link to the FQDN for our system, you can view the certificate live as Stan did.  Were not running it as a whole live system, but are giving it a good going over as live as can be if you get my drift.

Something still wierd with this issue, maybe its a RC0 problem, but would have expected this part to work as its quite important...

many thanks

Brett