Exchange Server Pro » OWA

SSL Certificate Trust Errors for New Thawte Certificates

Paul Cunningham — Fri, 27 Aug 2010 09:00:46 +0000

If you renew a Thawte SSL certificate or purchase a new one since 26th July 2010 you may encounter SSL certificate trust errors when clients connect to published websites such as Outlook Web Access.

Web browsers will return an error such as:

The security certificate issued by this website was not issued by a trusted certificate authority

On inspection of the certificate being issued by the website you may see this error:

The issuer of this certificate could not be found

This can be confusing for people who assume that any certificate issued by a commercial CA such as Thawte will be trusted by devices and web browsers that people are connecting from, especially when it occurs after renewing an existing Thawte SSL certificate.

Thawte has published the reason for this:

On June 27 2010, in the interest of better security, thawte signed all certificates with a primary and secondary intermediate that need to be installed along with the SSL certificate. Any certificate issued on or after this date requires the primary and secondary intermediate to be installed.

The new certificates are issued by an intermediate CA known as “Thawte SSL CA”. This CA is not automatically trusted by most web browsers. Thawte provides instructions for installing the correct certificates on the web server or ISA Server that is publishing the website.

Take note of the final steps, the change may not take effect until IIS or ISA Server are restarted.

If your site still have the chaining error, restart the IIS service. If the problem continues, the whole server needs a reboot to use the new roots.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server 2010 OWA Support Browser Matrix

Paul Cunningham — Fri, 09 Apr 2010 02:04:11 +0000

Microsoft’s Outlook Web App help site has the list of web browsers on different OS platforms that support the full Outlook Web App feature set.

To use the complete set of features available in Outlook Web App and the Web management interface, you can use the following browsers on a computer running Windows XP, Windows 2003, Windows Vista, or Windows 7:

Internet Explorer 7 and later versions.

Firefox 3.0.1 and later versions.

Chrome 3.0.195.27 and later versions.

On a computer running Max OS X, you can use:

Safari 3.1 and later versions.

Firefox 3.0.1 and later versions.

On a computer running Linux, you can use:

Firefox 3.0.1 and later versions.

If you use a Web browser that doesn’t support the full feature set, Outlook Web App will open in the light version.

The light version is primarily designed for accessibility for the visually impaired. However with its stripped down interface and limited features it is also useful when on slow connections and has the broadest browser compatiblity of the two versions.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Remote Connectivity Analyzer Updated

Paul Cunningham — Tue, 20 Oct 2009 00:08:29 +0000

Microsoft has released an update to the useful Exchange Remote Connectivity Analyzer. Announced by the MS Exchange Server Team today, the update includes:

New CAPTCHA interface
New tests for Exchange Web Services (useful for testing Entourage for Mac clients) and Outbound SMTP
Updates for Exchange 2010 Outlook Web Access
Password confirmation to reduce test failures from password typos
Removal of the “Beta” label

The tool also has a slick new interface. Check out the differences between the old site and the new site.

Old Exchange Remote Connectivity Test Interface

New Exchange Remote Connectivity Test Interface

Check out the Exchange Remote Connectivity Analyzer Tool.

Get more Exchange Server tips at ExchangeServerPro.com

Publish Exchange Server 2007 OWA Using ISA Server 2006

Paul Cunningham — Mon, 31 Aug 2009 08:30:27 +0000

Before we begin we must first use the same procedure used for migrating the SSL certificate from Exchange Server 2003 to Exchange Server 2007 to also migrate the certificate to the ISA Server 2006 firewall. Once an SSL certificate has been configured on the ISA server we can continue with the publishing rules for Outlook Web Access.

Open the ISA Server Management console and navigate to /Firewall Policy.

Click on Publish Exchange Web Client Access in the Tasks pane on the right side of the ISA Server Management Console.

Enter a meaningful name for the new publishing rule such as “Exchange Remote Access”. Click Next to continue.

Select the Exchange version Exchange Server 2007 and tick the Outlook Web Access box. Click Next to continue.

Choose Publish a single Web site or load balancer. Click Next to continue.

Choose Use SSL to connect to the published Web server or server farm as this is the most secure option. Click Next to continue.

Enter the FQDN of the Client Access Server. If for any reason your ISA Server is not able to resolve this name you should also tick the box and enter a name or IP that ISA can use to connect to the server. Click Next to continue.

Enter the Public Name of the server. This should match the name on the SSL certificate you imported on the Exchange and ISA servers, the External URL setting on the OWA virtual directory for the Exchange Client Access Server configuration, and the external DNS name that your clients use to connect to Exchange remote access. Click Next to continue.

Click New to create a new web listener for Exchange Remote Access.

Give the listener a meaningful name such as “ExchangeSSL”. Click Next to continue.

Choose Require SSL secured connections with clients. Click Next to continue.

Select the External network to listen for incoming web requests. If you have more than one external IP address you must click Select IP Addresses and specify which IP address bound to the External network to listen on. Click Next to continue.

Click Select Certificate and choose the SSL certificate you imported on the ISA Server firewall. Click Select and then click Next to continue.

Leave the authentication settings set to HTML Form Authentication with Windows (Active Directory). Click Next to continue.

Clear the Enable SSO check box. Click Next to continue.

Click Finish to complete the New Web Listener wizard. Select the web listener you have just created and click Next to continue.

Choose Basic Authentication for authentication delegation. Click Next to continue.

Note: Delegation using Basic authentication allows a single SSL certificate, public IP address, and ISA publishing rule to be used for all Exchange remote access methods (eg Outlook Web Access and Outlook Anywhere). In environments with multiple public IP addresses and a requirement to delegate Outlook Anywhere authentication using Kerberos/NTLM then Negotiate(Kerberos/NTLM) would be chosen.

Leave the users set to Authenticated Users. Click Next to continue.

Click Finish to complete the Publishing Rule wizard.

Right click the newly created rule and choose Properties.

Navigate to the Paths tab. Click the Add button to add more paths to the publishing rule for ActiveSync, AutoDiscover, and Outlook Anywhere.

Note: If you are planning to publish these services on separate IP addresses and SSL certificates you would not perform these steps.

Add the following paths:

/rpc/*
/Microsoft-Server-ActiveSync/*
/AutoDiscover/*

Click OK when you have added each of the paths to the rule.

Apply the ISA rule changes.

Get more Exchange Server tips at ExchangeServerPro.com

Configuring the Exchange Server 2007 Client Access Server

Paul Cunningham — Mon, 24 Aug 2009 16:04:16 +0000

Last week we looked at how to plan for an Exchange Server 2007 transition, how to prepare and install a new server to host Exchange Server 2007, and how to install the first Exchange Server 2007 server in the organization. This week we continue with configuring the new Exchange server roles, starting with the Client Access Server.

Open the Exchange Management Console and navigate to Server Configuration/Client Access.

Configure Outlook Web Access

Before Outlook Web Access is published to the internet you must enter the external URL. Open the properties of the owa (Default Web Site) and enter the external URL in the field shown here.

If you are publishing via ISA Server select the Authentication tab and choose Use one or more standard authentication methods, setting it to Integrated Authentication and Basic Authentication.

Click OK when complete. A warning will appear that the changes will not take effect until IIS is restarted.

Click OK but don’t worry about restarting IIS yet, we’ll be restarting it soon.

Configure ActiveSync

Similar to Outlook Web Access the ActiveSync external URL must be configured if it is being published to the internet. Choose the Exchange ActiveSync tab and then open the properties of Microsoft-Server-ActiveSync.

Enter the external URL in the field shown here.

Click OK when complete.

Configure Outlook Anywhere

In the Actions pane to the right of the Exchange Management Console click on Enable Outlook Anywhere.

Enter the external host name in the field shown here.

If you are publishing via an ISA Server on the same external IP address as Outlook Web Access then choose Basic Authentication. If you can dedicate an external IP address for publishing Outlook Anywhere then choose NTLM Authentication.

Click Enable when complete. You will receive a warning that Outlook Anywhere will not be available for up to 15 minutes. Click Finish to clear that warning.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server 2007 Update Rollup 6 (Critical)

Paul Cunningham — Thu, 12 Feb 2009 00:43:40 +0000

Microsoft has released Update Rollup 6 for Exchange Server 2007. The update includes a critical security fix outlined in bulletin MS09-003.

The full list of fixes can be found here, and the download files are here.

I’ve updated our Exchange servers here last night and it went smoothly, no problems encountered.

Make sure you read the release notes to be aware of the main issues encountered with Exchange update rollups:

customised OWA interfaces (backup your customisations as they will be overwritten by the update)
CAS-proxy deployments (update the internet-facing CAS first)
managed code services not starting after update (permit access from the server to the Microsoft CRL)

Link: Update Rollup 6 for Exchange Server 2007 Service Pack 1 (KB959241)

Get more Exchange Server tips at ExchangeServerPro.com

Exchange 2007 OWA stops working with “reason=0” error

Paul Cunningham — Fri, 30 Jan 2009 03:49:24 +0000

Outlook Web Access on Exchange Server 2007 may stop working after an Update Rollup is applied. Users who connect to OWA may receive a browser script error or a blank page with a URL of:

https://mail.yourdomain.com/owa/auth/logon.aspx?url=https://mail.yourdomain.com/owa/&reason=0

This problem can be caused by either of these conditions:

Cause #1

The Update Rollup was applied while the %systemdrive%\ExchangeSetupLogs folder was missing.

Resolution #1

Replace or restore the ExchangeSetupLogs folder and run the Update Rollup again.

Cause #2

The Update Rollup was applied while IIS services were stopped or disabled. This will be apparent when you inspect the %systemdrive%\ExchangeSetupLogs\UpdateOwa.log file and find entries with the following text:

Getting all Exchange 2007 OWA Virtual Directories
There are no Exchange 2007 OWA Virtual Directories. Aborting.

Resolution #2

Enable and start the IIS services (which are required for the Client Access Server role) and run the Update Rollup again.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange 2007 mailbox users with incorrect language settings

Paul Cunningham — Mon, 19 Jan 2009 03:33:13 +0000

Users may report that their Exchange mailbox displays in an incorrect foreign language in Outlook and Outlook Web Access. This issue may occur when the Languages attribute of the mailbox is incorrectly set.

You can view the language of a mailbox using the Get-Mailbox cmdlet.

[PS] C:\>Get-Mailbox -Identity "John Smith" | fl name, languages

Name      : John Smith
Languages : {en-AU}

To see all mailboxes that do not match the language you are expecting you can use this PowerShell command, where “en-AU” is the expected language in this example:

[PS] C:\>Get-Mailbox | where {$_.languages -ne "en-AU"} | fl name, languages

Name      : Peter James
Languages : {en-US}

Name      : Frank Wu
Languages : {zh-CN}

To set a user mailbox to the language you desire use the Set-Mailbox cmdlet.

[PS] C:\>Set-Mailbox -Identity "Frank Wu" -Languages "en-AU"

Link: How to change the languages for a user mailbox

Get more Exchange Server tips at ExchangeServerPro.com

Test your Exchange Server remote connectivity

Paul Cunningham — Tue, 06 Jan 2009 23:18:54 +0000

When deploying or troubleshooting Exchange servers I regularly encounter the need to jump onto a host outside of the customer network to perform remote access testing. Over the years I’ve gotten into the habit of maintaining a host running 24/7 on my home internet connection that I can RDP to and perform these test. While this has been useful in the past it is also a massive pain (not to mention costs me electricity) to manage this host and keep it running so that it is always available when I need it.

A few days ago I learned about the Microsoft Exchange Server Remote Connectivity Analyzer, and this morning I had cause to give it a try for the first time.

The Microsoft Exchange Server Remote Connectivity Analyzer lets you perform useful tests such as ActiveSync, Autodiscover, Outlook Anywhere, and inbound SMTP. I ran through the ActiveSync test to verify for one of our remote staff that it was working properly.

The test required valid network credentials in order to perform its analysis. Though the site is owned and run by Microsoft and the credentials are transmitted via SSL if you had any security or privacy concerns you could simply create a temporary account for the tests and then change its password or delete it immediately afterwards.

In summary, a great tool and one that goes a long way to solving the headache of properly testing new Exchange Server deployments at customer networks.

Get more Exchange Server tips at ExchangeServerPro.com

Troubleshooting Exchange Server 2007 Outlook Web Access Logon Failure

Paul Cunningham — Thu, 01 Jan 2009 03:20:34 +0000

From the Microsoft Exchange Team Blog:

Despite our attempts at documenting various break/fix scenarios, it can often be frustrating when trying to locate the information you need to resolve an issue as quickly as you would like. I decided to share this information in an attempt to help you resolve the majority of issues that can prevent your users from successfully logging on to Outlook Web Access.

Read more…

Link: Troubleshooting Outlook Web Access Logon Failures in Exchange Server 2007

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server Pro » OWA

SSL Certificate Trust Errors for New Thawte Certificates

Related posts:

Exchange Server 2010 OWA Support Browser Matrix

Related posts:

Exchange Remote Connectivity Analyzer Updated

Related posts:

Publish Exchange Server 2007 OWA Using ISA Server 2006

Related posts:

Configuring the Exchange Server 2007 Client Access Server

Configure Outlook Web Access

Configure ActiveSync

Configure Outlook Anywhere

Related posts:

Exchange Server 2007 Update Rollup 6 (Critical)

Related posts:

Exchange 2007 OWA stops working with “reason=0” error

Cause #1

Resolution #1

Cause #2

Resolution #2

Related posts:

Exchange 2007 mailbox users with incorrect language settings

Related posts:

Test your Exchange Server remote connectivity

Related posts:

Troubleshooting Exchange Server 2007 Outlook Web Access Logon Failure

Related posts: