Open the
Internet Services Manager, and right-click on Default Web Site (or the site
hosting your OWA component.) Select Properties.
Under the
Directory Security tab, click Server Certificate.
Click
next. Select 'Create a new certificate' and hit next
Select
'Prepare the request now, but send it later' and hit next.
Enter a
name for the certificate that you can identify on your server. Choose a
bit-length of 2048. Leave the other boxed un-checked.
Enter the
full legal name of your company. Enter a department such as 'Security' or
'IT' in the organizational unit.
Enter the
fully qualified domain name of your Outlook Web Access (ex.
mail.yourdomain.com).
Enter the
location of your organization: Country, State, and City.
Choose a
file name and a location to save your Certificate Signing Request (CSR). The
file should be saved as a text file (.txt)
Click next
to generate the file.
11.You have now created a "Certificate
Signing Request" which will
be needed when you apply for your certificate.
Certificate Installation
Open
Internet Services Manager from your Administrative Tools.
Open the
Properties for the Web Site that is hosting OWA (normally the Default Web
Site).
Select the
"Directory Security" tab and click "Server Certificates".
You will
now be presented with the "Pending Certificate Request" dialog box
(below), select "Process the pending request and install the certificate",
click Next.
The "Process
a Pending Request" dialogue box will appear (below), navigate to the
site certificate that you received. click Next.
You will
now be presented with the "Certificate Summary" (below), click Next.
Install the
intermediate certificate :
You
have now installed the SSL certificate into our web site. Next enable SSL for
OWA.
Using the
Internet Services Manager, open the properties for the "Exchange"
virtual directory.
Select the
"Directory Security" tab and the click on the "Edit" button in
the Secure Communication section.
In the "Secure
Communications" dialog box (below), check the box "Require Secure
Channel (SSL)". You can also check the box "Require 128-bit
encryption", if you do check the 128-bit checkbox, any browsers that do
not support 128-bit encryption will be unable to connect to OWA.
When users
enter http://ahost.adomain.com/exchange,
they will receive an "HTTP 403.4 - Forbidden: SSL required Internet
Information Services" error message, because OWA is configured to require
SSL. SSL uses the HTTPS protocol, so users would need to enter the url as
https://ahost.adomain.com/exchange.
Please see the Microsoft article regarding forcing the use of SSL with OWA
Finally,
ensure that your Firewall is configured to allow HTTPS (port 443 by
default) to pass through.
