<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Brad,<br>
<br>
Brad Morgan wrote:
<blockquote cite="mid:011101cc256b$de3056a0$9a9103e0$@net" type="cite">
<meta http-equiv="Content-Type" content="text/html; ">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">I have a need to put a real SSL Certificate on a
Windows Small Business Server running Exchange. The domain is
currently hosted at GoDaddy and they provide both web hosting and
email. The email is fetched from GoDaddy into Exchange using the
POP3Connector (and sent using an external SMTP server ("Smarthost").
Exchange provides a web interface and when you attach to this web
interface, you get a certificate error which you can click through to
get to it.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Blackberry smart phones can attach to this
configuration and while they initially complain about the certificate,
the phone can be convinced to ignore the error (permanently). A Windows
smart phone gets the certificate error and punts, creating the need for
a real certificate.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Does anyone on this list have any experience
with SSL certificates that can clue me in on what I need to do?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Brad<o:p></o:p></p>
</div>
<pre wrap="">
<hr size="4" width="90%">
</pre>
</blockquote>
The way SSL certificates work is as follows. The certificate
authorities somehow get their public key (root certificate) in web
browsers and internet software such as Internet Explorer, Firefox,
Chrome, etc. This might involve the exchange of large sums of money
from the certificate authority to the software company, or at least
some bribes or hookers and blow or something. Either way, it is
generally not possible for individuals to get their own root
certificate authority certificates installed in every web browser and
device with internet access because the process can get expensive.<br>
<br>
Anyway once the root certificate is out there in every client device,
the certificate authority can then turn around and charge businesses
and individuals like yourself $bigbucks per byte for their "signature"
on your own web server's public key (the "certificate" for your web
server). With their blessing and signature, then client devices like
your phone will accept the certificate because it's been signed by
someone that the phone believes to be legit.<br>
<br>
You have 2 options:<br>
<br>
1. Buy a commercial SSL certificate from a commercial certificate
authority (Verisign = $$$) for your exchange server. Then install the
certificate on your web server and your phone will talk to it over SSL
and not throw any error messages.<br>
<br>
2. Create your own certificate authority, it is super easy and will
take you 5 to 50 minutes depending on what software you have and if you
can find the right documentation. Then you'd need to import your own
certificate authority's "root certificate authority certificate" into
your phone. Then you'd create another SSL key pair (the private key
and "certificate") for your Exchange server, sign the certificate with
your certificate authority, and then your phone will accept the
self-signed certificate without throwing an error.<br>
<br>
I hope this helps,<br>
Jim<br>
<pre class="moz-signature" cols="72">--
Jim Ockers, P.Eng. (<a class="moz-txt-link-abbreviated" href="mailto:ockers@ockers.net">ockers@ockers.net</a>)
Contact info: <a class="moz-txt-link-freetext" href="http://www.ockers.net/msi.html">http://www.ockers.net/msi.html</a>
</pre>
</body>
</html>