RE: OWA, IIS and SSL

From: Edgar Yanez [MS] (eyan@online.microsoft.com)
Date: 12/30/02


From: eyan@online.microsoft.com (Edgar Yanez [MS])
Date: Mon, 30 Dec 2002 17:16:19 GMT


Emily,

SYMPTOMS
========
When a client computer that is running Microsoft Internet Explorer attempts
to enroll for a certificate against a Windows NT 4.0 version 1
Certification Authority (CA), the client may be unable to enroll, or the
enrollment process may not support the expected advanced options.

CAUSE
=====
This problem occurs because the Windows NT 4.0 CA does not recognize the
latest versions of Internet Explorer; thus, the expected functionality is
not present for these clients.

RESOLUTION
==========
To resolve this problem, edit the Browscap.ini file on the Windows NT 4.0
CA to add browser recognition for the latest versions of Internet Explorer.
To do so, add the following information to the Browscap.ini, which is
located in the %SystemRoot%\System32\Inetsrv folder on the server.

NOTE: This sample contains Internet Explorer 5, 5.<x>, and 6.

        
        ;;ie 5.0
        [IE 5.0]
        browser=IE
        Version=5.0
        majorver=#5
        minorver=#0
        frames=TRUE
        tables=TRUE
        cookies=TRUE
        backgroundsounds=TRUE
        vbscript=TRUE
        javascript=TRUE
        javaapplets=True
        ActiveXControls=TRUE
        Win16=False
        beta=False
        AK=False
        SK=False
        AOL=False
         
        ;;ie 5.x
        [Mozilla/4.0 (compatible; MSIE 5.*; Windows NT)]
        parent=IE 5.0
        version=5.0
        minorver=0
        platform=WinNT
         
        ; Default Browser
        [*]
        browser=Default
        frames=FALSE
        tables=TRUE
        cookies=FALSE
        backgroundsounds=FALSE
        vbscript=FALSE
        javascript=FALSE
        
        ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; IE 6.0
        [IE 6.0]
        browser=IE
        Version=6.0
        majorver=6
        minorver=0
        frames=True
        tables=True
        cookies=True
        backgroundsounds=True
        vbscript=True
        javaapplets=True
        javascript=True
        ActiveXControls=True
        Win16=False
        beta=True
        AK=False
        SK=False
        AOL=False
        Update=False
         
        [Mozilla/4.0 (compatible; MSIE 6.*; Windows 95*)]
        parent=IE 6.0
        platform=Win95
        beta=True
         
        [Mozilla/4.0 (compatible; MSIE 6.*; Windows 98*)]
        parent=IE 6.0
        platform=Win98
        beta=True
         
        [Mozilla/4.0 (compatible; MSIE 6.*; Windows NT*)]
        parent=IE 6.0
        platform=WinNT
        beta=True
         
        [Mozilla/4.0 (compatible; MSIE 6.*)]
        parent=IE 6.0
                                        

STATUS
======

Microsoft has confirmed that this is a problem in the Microsoft products
that are listed at the beginning of this article.

MORE INFORMATION
================

The Browscap.ini file works with the browser components that are included
with Microsoft Internet Information Server (IIS) 4.0. This component checks
the version of the browser to measure its capabilities. If the Browscap.ini
does not contain the client's browser, functionality of that browser may be
limited. Earlier versions of this file do not contain the latest versions
of Internet Explorer. Windows NT 4.0 Service Packs may update this file,
but to support Internet Explorer 6, you have to manually update the
Browscap.ini file.

Thank You
Edgar Yanez
DSM IIS Support

This posting is provided "AS IS" with no warranties, and confers no rights.
You assume all risk for your use. © 2001 Microsoft Corporation. All rights
reserved.
Please do not send email directly to this alias. This is our online account
name for newsgroup participation only.

--------------------
| Content-Class: urn:content-classes:message
| From: "Emily Blum" <eblum@tmfutures.com>
| Sender: "Emily Blum" <eblum@tmfutures.com>
| References: <07a101c2a7a9$8d3900b0$89f82ecf@TK2MSFTNGXA01>
<$fHuJYmqCHA.1232@cpmsftngxa09>
<053501c2aa85$33206ad0$d2f82ecf@TK2MSFTNGXA09>
<YAhbv2wqCHA.2248@cpmsftngxa09>
| Subject: RE: OWA, IIS and SSL
| Date: Fri, 27 Dec 2002 10:28:15 -0800

| Yes, I am using client certificates. This is where the
| error occurs. When I try to open the certificate I get an
| error message "error '800a01ce'"
| /CertSrv/CertEnroll/kgaccept.asp, line 21
| I'm not sure how to research this error.
| Thanks.
| Emily Blum
| >-----Original Message-----
| >Are you using client certificates for your SSL
| connections? If so, when
| >given a choice to open or save the cert, go ahead and
| open it. Run the
| >installation wizard to install the client cert then try
| your connection
| >again.
| >
| >Sincerely,
| >
| >Tim Greene MCSE, MCSA, MCP+I
| >IIS Newsgroup Support
| >
| >Please do not send email directly to this alias. This is
| our online account
| >name for newsgroup participation only.
| >
| >If you would like to open a support incident with
| Microsoft, call
| >1-800-936-5800
| >
| >This posting is provided "AS IS" with no warranties, and
| confers no rights.
| >You assume all risk for your use. © 2001 Microsoft
| Corporation.
| >
| >.
| >
|



Relevant Pages

  • IE https certificate attack
    ... A flaw in Microsoft Internet Explorer allows an attacker to perform ... server name with the name stored in the certificate. ... There is a flaw in the way IE checks HTTPS objects that are embedded into ... I don't know the source code of the Internet Explorer I cannot check the ...
    (Bugtraq)
  • Re: Cannot connect to RWW using IE 7
    ... In the Reset Internet Explorer Settings dialog box, ... Certificate Error: Navigation Blocked - Windows Internet Explorer ... Microsoft Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • Does SslStream support anonymous Diffie-Hellman ciphersuites?
    ... I am trying to build SSL server using the .NET 2.0 ... The client is beyond my control and supports only the DH anonymous ... the only difference was using -sp "Microsoft DH SChannel Cryptographic ... (certificate generated with -sp "Microsoft RSA SChannel Cryptographic ...
    (microsoft.public.dotnet.security)
  • RE: Client Certificate Error
    ... The client works on the other two sites. ... upgrade to IE5 SP2 ... >> Subject: Client Certificate Error ... >© 2001 Microsoft Corporation. ...
    (microsoft.public.inetserver.iis.security)
  • An NTE_BAD_DATA error returned by CryptDecrypt()
    ... Microsoft Certificates and Crypto API. ... Currently the SSL connection between my client and server works, ... "Microsoft Enhanced Cryptographic Provider v1.0", ... I created the user certificate and its trust point, ...
    (microsoft.public.security)