Re: Certificates/SSL Connections From Behind ISA
- From: "ZVR" <no_spam_ever@xxxxxx>
- Date: Thu, 30 Mar 2006 14:15:28 -0500
I found "Configuring Internal Client Access To Web Sites Over SSL" which
is
obviously exactly what I want to do:
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/client_ssl.mspx
And it's simple enough, but I can't seem to get the certificate from the
external website properly installed on the isa server.
You know what, I am just revisiting your other thread and I don't think that
this is what you need.
First of all that section of the article talks about web chaining by
redirecting http requests from your clients as https requests to the
destination site. You should not need to do this with your setup.
Second, for web chaining to work that way you don't install a (web) server
certificate on the ISA computer (which is what you seem to be doing), you
actually install a client certificate used for authentication to the
destination site. Again not what you want, that Checkpoint site is not using
certificate-based authentication, or is it?
(Please note that there is a difference between authentication and data
encryption; traffic would be SSL-encrypted using certificates but that does
not necessarily mean the initial authentication part is handled via
certificates too).
Here's a thought for you. What Java Virtual Machine are you using on your
client(s)? Did you install Sun's JVM, thus replacing the Microsoft VM? There
is a known issue with Sun's JVM and NTLM pass-through authentication, which
can only be solved by enabling "basic authentication" on the ISA web proxy
listener, in addition to "integrated". You will still get one extra
authentication prompt though.
A way to confirm whether this is your problem is to allow anonymous http(s)
connections from that particular client, by creating an "allow" rule that
does not require authentication for that IP (allows access to "All Users"
not some specific users/groups). Also uou have to make sure that the option
"Require all users to authenticate" is not enabled on the web proxy
listener. If after you make these changes you get through, then you can be
100% sure the problem lies with the Sun JVM.
Virgil
.
- Prev by Date: Re: ISA FBA Issues with OWA
- Next by Date: Re: ISA FBA Issues with OWA
- Previous by thread: Re: Certificates/SSL Connections From Behind ISA
- Index(es):
Relevant Pages
|
