Re: SSL POP3 works only locally if cert name is used

Thanks Austin

I have tested this in our own enviroment but have still problems. If I check
from:
http://www.mxtoolbox.com/index.aspx
what they say about our mx records the results are:
10 mail.tukikomppania.fi 83.145.241.28
The IP is our public.

Still eg. Outlook POP3 Client gets the warning message that "The target
pricipal name is incorrect. If I press View Certificate... I can see:
The certificate information:
issued to mail.tukikomppania.fi
issued by mail.tukikomppania.fi
valid 5 years

Is there a way to "trust the self signed cert on the external clients and
receive no errors"?

The server's FQDN is computername.tukikomppania.local (it is not
mail.tukikomppania.fi). I will check what happens following Pedro's
instructions.

Rgs,

Juha

"Austin Smith" wrote:

you certianly want to have the ssl cert reflect your public domain name.
This way, you can trust the self signed cert on the external clients and
receive no errors.

depending on the mobile device, (ie for windows mobile devices) you will
have to import the self signed cert to the phone and trust it before you can
sync OTA (over the air).

HTH,
Austin Smith, A+, MCP
Digital Son, I.T. Services

"Juha" <Juha@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:421D52C8-4344-49BA-8C2E-FB90CB21D944@xxxxxxxxxxxxxxxx
Hi

Have installed SSL POP3 in 2003 sbs std. with one nic. Forfarded in HW FW
these ports to servers local IP:

25 smtp (traditional Exchange works fine)
443 SSL (Owa works fine allready)
995 SSL POP3
993 SSL IMAP (to release after POP3 works)

ISP has pointed A-record mail.domainname.fi to FWs public IP
Servers FQDN is somethinelse.domainname.fu
The sertificate is issued to mail.domainname.fi by mail.domainname.fi, so
it
is self made by sbs server using CEICW.

If Outlook Client is configured to receive mail from our public IP
(incoming
mail server) it works fine (well, promts about untrusted certificate) also
from Internet.
If Outlook Client is configured to receive mail from mail.domainname.fi
(incoming mail server) it doesn't work but locally only, not from
Internet.

1. Any ideas how I can success to use mail.domainname.fi address?
2. How can I install this certificate to client workstations. Actully
where
is the file? I have apx 25 non domain WSs around the country. Should I
send
the certificate to them burned in CD by mai?. Is it secure to send the
certificate by email?

Additionally our customer needs OMA in the future. They will use Nokia
phones for that. Anything special keep in mind.

Thanks, in advantage

Juha




.

Relevant Pages

  • Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
    ... SSL only validates you are talking to a SSL certified server; ... They can simply edit the URL the client program ... can be done by using a X.509 certificate on both ends, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: LDP client authentication fails
    ... I got the LDP working with LDAP server under server client authentication ... I did not installed the certificate in pfx format .. ... Client cert auth won't work without that. ...
    (microsoft.public.windows.server.active_directory)
  • Re: SSL & Man In the Middle Attack
    ... >> it possible for the middle man to intercept all messages from server to me ... > server sends client a signed message along with a digital certificate. ... > client generates a random secret key, ...
    (comp.security.misc)
  • Re: activesync issue
    ... On the SBS 2003 Server open the Server Management console. ... On the "Web Server Certificate" page, choose to create a new Web server ... Install the new certificate which created in above step on mobile device: ... Access to browse the Exchange Server 2003 client after you install ...
    (microsoft.public.windows.server.sbs)
  • Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
    ... order to detect we are connected to the wrong server (even though its SSL ... certificate is OK and valid by Verisign); we would need a client certificate. ... this can be detected by SSL/HTTPS client in ...
    (microsoft.public.dotnet.framework.aspnet.security)