This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Certificates required - WAF for MS Exchange

Hi folks

Sorry if this sounds trivial, but this is the first time I've used the Web Application Firewall for a production system using proper certificates, and I want to make sure I'm not about to make an expensive mistake!

I've followed the Sophos document on how to configure the UTM 9.2 WAF for Exchange connectivity, and I've got it to work using private certificates. I now want to replace my home-brew certificates with one(s) from one of the major certificate authorities. My question is - what do I need?

I've got three virtual servers configured:
  autodiscover..com
  outlook..com
  webservices..com

1. Do I just need certificates to cover the above external names, or do I need to worry about the internal DNS names for the exchange server as well?

2. Three separate certificates (which is what I used while testing) or one SAN certificate? Does it matter?

3. If a SAN certificate, does it matter which name goes in the subject field? (as you can guess, I'm not too knowledgeable about SAN certificates...)

Any other problems or "gotcha"s that I should be aware of when buying certificates for use with Sophos UTM?

Thanks for any guidance anyone can give...
Ifor

This thread was automatically locked due to age.

Parents

0 Ifor Davies over 10 years ago

Thanks mod2402 and vilic - I think I've got it now:

To get the reverse proxy/Exchange stuff working properly, I just need certificates (SAN or otherwise) that cover the external host names

However, if I use a SAN certificate that also includes the internal host names:
- On the plus side, the internal clients won't show certificate errors
- On the minus side, the internal host names will be on the Internet for all and sundry to see

Is this a fair summary?
Cancel
Vote Up 0 Vote Down

Cancel
0 twister5800 over 10 years ago in reply to Ifor Davies

Thanks mod2402 and vilic - I think I've got it now:

To get the reverse proxy/Exchange stuff working properly, I just need certificates (SAN or otherwise) that cover the external host names

However, if I use a SAN certificate that also includes the internal host names:
- On the plus side, the internal clients won't show certificate errors
- On the minus side, the internal host names will be on the Internet for all and sundry to see

Is this a fair summary?

See this:
https://www.bluessl.com/en/help/internal-server-names

1. july 2012 will certificate providers no longer issue internal names. Off course you can do self issued, but as mod2402 and vilic says, you will have to use both name for internal and external setup for Outlook Anywhere a.s.o.

You setup split-dns internally so EVERYBODY use the external names, here is a script that can do this for you:

Script for Configuring Exchange 2010 Internal and External URLs | msunified.net

The above for Exchange 2007 and 2010 [[;)]]

Split DNS:

Internally point EXTERNAL names to the INTERNAL MAILSERVER IP on the INTERNAL DNS SERVER

Externally point EXTERNAL names to the EXTERNAL MAILSERVER IP on the EXTERNAL DNS SERVER. (Your domain provider)

If you do this and ex. you use Outlook Anywhere, their configuration will work internally AND externally, without the need to change anything [[;)]]

AND with NO certificate warnings at all...

-----

Best regards
Martin

Sophos XGS 2100 @ Home | Sophos v20 Technician
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 twister5800 over 10 years ago in reply to Ifor Davies

Thanks mod2402 and vilic - I think I've got it now:

To get the reverse proxy/Exchange stuff working properly, I just need certificates (SAN or otherwise) that cover the external host names

However, if I use a SAN certificate that also includes the internal host names:
- On the plus side, the internal clients won't show certificate errors
- On the minus side, the internal host names will be on the Internet for all and sundry to see

Is this a fair summary?

See this:
https://www.bluessl.com/en/help/internal-server-names

1. july 2012 will certificate providers no longer issue internal names. Off course you can do self issued, but as mod2402 and vilic says, you will have to use both name for internal and external setup for Outlook Anywhere a.s.o.

You setup split-dns internally so EVERYBODY use the external names, here is a script that can do this for you:

Script for Configuring Exchange 2010 Internal and External URLs | msunified.net

The above for Exchange 2007 and 2010 [[;)]]

Split DNS:

Internally point EXTERNAL names to the INTERNAL MAILSERVER IP on the INTERNAL DNS SERVER

Externally point EXTERNAL names to the EXTERNAL MAILSERVER IP on the EXTERNAL DNS SERVER. (Your domain provider)

If you do this and ex. you use Outlook Anywhere, their configuration will work internally AND externally, without the need to change anything [[;)]]

AND with NO certificate warnings at all...

-----

Best regards
Martin

Sophos XGS 2100 @ Home | Sophos v20 Technician
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data