OWA works, RPC over HTTP does not

From: Kay Obermueller <kobermueller@xxxxxxxxxxx>
Date: Thu, 19 May 2005 18:07:23 +0200

Hello everyone, we have an Exchange 2003 server running as front end and back end server at once. The server is behind NAT and port 443 is forwarded to the Exchange server. We use an own root CA on another machine with Openssl. A host certificate is made for the Exchange server. The cert of the root CA is installed into the store for trusted root CA's on the Exchange server and onto a client machine also. With this as preparation Outlook web access is configured and works even without asking for accepting the host cert of the server. But Outlook via RPC over HTTP does not. It seems that the client drops the connection. Here is an excerpt of captured packets by ethereal (194.35.207.125 is the server):


Source            Destination

This sequence I get a very few times:

10.168.0.37 194.35.207.125 TCP 2646 > https [SYN] Seq=0 Ack=0 Win=65535 Len=0 MSS=1460 194.35.207.125 10.168.0.37 TCP https > 2646 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1300 10.168.0.37 194.35.207.125 TCP 2646 > https [ACK] Seq=1 Ack=1 Win=65535 Len=0 10.168.0.37 194.35.207.125 TLS Client Hello 194.35.207.125 10.168.0.37 TLS Server Hello, Certificate, Server Hello Done 10.168.0.37 194.35.207.125 TLS Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message 194.35.207.125 10.168.0.37 TLS Change Cipher Spec, Encrypted Handshake Message 10.168.0.37 194.35.207.125 TCP 2646 > https [ACK] Seq=253 Ack=1099 Win=64437 Len=0 10.168.0.37 194.35.207.125 TLS Application Data 10.168.0.37 194.35.207.125 TCP 2647 > https [SYN] Seq=0 Ack=0 Win=65535 Len=0 MSS=1460 194.35.207.125 10.168.0.37 TCP https > 2647 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1300 10.168.0.37 194.35.207.125 TCP 2647 > https [ACK] Seq=1 Ack=1 Win=65535 Len=0 10.168.0.37 194.35.207.125 TLS Client Hello 194.35.207.125 10.168.0.37 TLS Application Data 194.35.207.125 10.168.0.37 TCP https > 2646 [FIN, ACK] Seq=1313 Ack=563 Win=64973 Len=0 10.168.0.37 194.35.207.125 TCP 2646 > https [ACK] Seq=563 Ack=1314 Win=65535 Len=0 194.35.207.125 10.168.0.37 TLS Server Hello, Certificate, Server Hello Done 10.168.0.37 194.35.207.125 TLS Client Key Exchange, Change Cipher Spec, Certificate Request[Unreassembled Packet] 194.35.207.125 10.168.0.37 TLS Change Cipher Spec, Encrypted Handshake Message 10.168.0.37 194.35.207.125 TLS Application Data 10.168.0.37 194.35.207.125 TLS Application Data 10.168.0.37 194.35.207.125 TLS Application Data 194.35.207.125 10.168.0.37 TLS Application Data 194.35.207.125 10.168.0.37 TCP https > 2647 [FIN, ACK] Seq=1313 Ack=653 Win=64883 Len=0 10.168.0.37 194.35.207.125 TCP 2647 > https [ACK] Seq=653 Ack=1314 Win=65535 Len=0 10.168.0.37 194.35.207.125 TCP 2646 > https [RST, ACK] Seq=688 Ack=1314 Win=0 Len=0 10.168.0.37 194.35.207.125 TCP 2647 > https [RST, ACK] Seq=653 Ack=1314 Win=0 Len=0


This sequence I get always:

10.168.0.37 194.35.207.125 TCP 2649 > https [SYN] Seq=0 Ack=0 Win=65535 Len=0 MSS=1460 194.35.207.125 10.168.0.37 TCP https > 2649 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1300 10.168.0.37 194.35.207.125 TCP 2649 > https [ACK] Seq=1 Ack=1 Win=65535 Len=0 10.168.0.37 194.35.207.125 TLS Client Hello 194.35.207.125 10.168.0.37 TLS Server Hello, Certificate, Server Hello Done 10.168.0.37 194.35.207.125 TLS Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message 194.35.207.125 10.168.0.37 TLS Change Cipher Spec, Encrypted Handshake Message 10.168.0.37 194.35.207.125 TLS Application Data 194.35.207.125 10.168.0.37 TLS Application Data 194.35.207.125 10.168.0.37 TCP https > 2649 [FIN, ACK] Seq=1313 Ack=562 Win=64974 Len=0 10.168.0.37 194.35.207.125 TCP 2649 > https [ACK] Seq=562 Ack=1314 Win=65535 Len=0

Here a second connection starts:

10.168.0.37 194.35.207.125 TCP 2650 > https [SYN] Seq=0 Ack=0 Win=65535 Len=0 MSS=1460 194.35.207.125 10.168.0.37 TCP https > 2650 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1300 10.168.0.37 194.35.207.125 TCP 2650 > https [ACK] Seq=1 Ack=1 Win=65535 Len=0 10.168.0.37 194.35.207.125 TLS Client Hello 194.35.207.125 10.168.0.37 TLS Server Hello, Certificate, Server Hello Done 10.168.0.37 194.35.207.125 TLS Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message 194.35.207.125 10.168.0.37 TLS Change Cipher Spec, Encrypted Handshake Message 10.168.0.37 194.35.207.125 TLS Application Data 10.168.0.37 194.35.207.125 TLS Application Data 10.168.0.37 194.35.207.125 TLS Application Data 194.35.207.125 10.168.0.37 TLS Application Data 194.35.207.125 10.168.0.37 TCP https > 2650 [FIN, ACK] Seq=1313 Ack=555 Win=64981 Len=0 10.168.0.37 194.35.207.125 TCP 2650 > https [ACK] Seq=652 Ack=1314 Win=65535 Len=0 10.168.0.37 194.35.207.125 TCP 2649 > https [RST, ACK] Seq=687 Ack=1314 Win=0 Len=0 10.168.0.37 194.35.207.125 TCP 2650 > https [RST, ACK] Seq=652 Ack=1314 Win=0 Len=0

A few times I get "[Unreassembled Packet]" as in the first block, but normally it is like in the second block. It seems to me as if the https connection was already working, but is afterwards dropped by the client in the last two lines. Also it's not clear to me, why there are two connections. Does anyone have an idea? Or can anyone post sniffed packets from a working configuration to compare? Thanks in advance!

Kay
.

Follow-Ups:
- Re: OWA works, RPC over HTTP does not
  - From: Ed Woodrick

Prev by Date: Re: Galmod
Next by Date: RE: Unable to email a disabled user
Previous by thread: Sync 2 Calendars - Possible ?
Next by thread: Re: OWA works, RPC over HTTP does not
Index(es):
- Date
- Thread

Relevant Pages

Re: Disable StartTLS on EX2007 Send Connectors
... I notice it only occurs when Exchange makes a connection to another server ... You can however change the FQDN on the send connector however to match ... Everytime it hits another server that offers TLS ... Ensure the built-in self cert that Exchange ...
(microsoft.public.exchange.admin)
Re: Using TLS to Secure Email
... done a bit of testing with TLS at my current job. ... same cert on the SMTP Virtual Server as well. ... "Kevin Bachelder" wrote in message ... > I will be migrating to Exchange 2003 in the next few weeks. ...
(microsoft.public.exchange.admin)
Re: Receive Connector authentication and Permission
... TLS is opportunistic I ... certificates installed (on the Exchange 2003 virtual server and the Exchange ... connector setup incorrectly, as the Exchange 2003 server recieves mail ...
(microsoft.public.exchange.admin)
Re: TLS on exchange 2003
... MVP - Exchange ... server as per the KB article in your other reply. ... Correct - just as you're configuring a Connector for outbound mail to their ... get mail without TLS ...
(microsoft.public.exchange.admin)
RE: 802.1x and PEAP
... > server authenticating ... > protected by the TLS session or a protected ... The initial identity exchange is used ... > protection, URL filtering, VPN, ...
(Security-Basics)