Re: Trusted CA question

From: David Cross [MS] (dcross_at_online.microsoft.com)
Date: 03/31/04 

Date: Wed, 31 Mar 2004 05:30:13 -0800

I wish I could give you an easy answer for this one - there is no simple
solution to deploy trusted roots outside of the default roots that are
trusted in the operating system or those that you distribute through group
policy in AD. 

-- 
David B. Cross [MS]
--
This posting is provided "AS IS" with no warranties, and confers no rights.
http://support.microsoft.com
"620" <no@no.no> wrote in message
news:7LCdnaRCDKcsNvTd4p2dnA@speakeasy.net...
> I'm new to this certificate game so bear with me here:
>
> I've established a windows domain, 'somedomain.com'.  To this, I've added
an
> IIS box and named it 'www'.  The IIS box's fully qualified name is
> 'www.somedomain.com' and it faces both the internet and intranet,
> dual-nic'd.  'www.somedomain.com' is publically registered to the IIS
box's
> public IP on it's public-side nic, from where a company web site is
served.
>
> I need secure communications on the IIS box over the net.  Because the
> external clients accessing the IIS box are stictly employees and clients,
I
> don't really need a "trusted" verisign cert to assure anonymous ecommerce
> visitors of my authenticity, etc.  My web visitors already "trust" me in
> that regard.  I just need SSL turned on to protect some data transmissions
> with people who already trust me, on a human level anyway.  So I installed
> certificate services on the IIS box (at which point it issued it's own
'root
> CA' cert to itself, or so I've managed to ascertain) and then browsed to
my
> own certsrv web service and, via that interface, issued myself a
certificate
> for conducting SSL web transactions.  So now the IIS box has 2 certs, one
> for being the root and one for the site, and in the IIS manager I attached
> the SSL cert to the website and turned on SSL.  So far, this all appears
to
> working as intended - well sort of.
>
> Initially, when an internal client accesses the website, there is a
security
> alert - the certificate's date is ok, and the name matches, but it's not
> from a trusted root CA.  Which makes sense, because 'www.somedomain.com'
> isn't on IE's default list of trusted CA's.  But that's OK, because I
could
> go into the advanced dialog of the alert message, view the certificate
path,
> and choose to install 'www.somedomain.com' root CA cert into the client's
> local store of trusted issuing CAs.  Alert message solved, browser is
happy
> with my certs.
>
> From the internet, external testing is popping up the same message just as
> I'd expect.  But!  And finally we reach my problem - the certificate path
> only shows the site's SSL cert - the issuing CA cert is not there.  The
path
> consists of 1 cert, not 2.
>
> My questions are:
>
> Why is the cert path "incomplete" when accessing the site externally (i.e.
> from the web).  Is this a naming/scope issue?
>
> Is there a best practice to get my root CA cert installed on the web
> clients?  Preferably something a user could do, given some brief
> instructions...
>
> TIA
>
>
>

Relevant Pages

  • Re: ** READ THIS BEFORE POSTING - answers to frequently asked questions 2003.08.15
    ... Here's how to enable SSL in IIS 5.0, not sure if 5.1 is different. ... XP comes with a different mini-IIS MMC that is confusing to me and does not ... Regarding your cert question, you have a choice of using the test cert from ...
    (microsoft.public.inetserver.iis.security)
  • Re: makecert
    ... You do need to have IIS installed in order to use this tool. ... I wouldn't worry about anything in IIS getting hosed unless you had SSL ... that in the IIS MMC by putting the previous cert back. ... You can then import it into the personal store for the ADAM service account ...
    (microsoft.public.windows.server.active_directory)
  • Re: SSL and OWA
    ... I just used metabase explorer to make sure I was importing the cert into the ... IIS is where most of the work ... I've attempted to enable the ssl, run iisreset that recheck use forms based ... auth in the exchange virtual server properties in exchange manager and I get ...
    (microsoft.public.exchange.admin)
  • Trusted CA question
    ... I'm new to this certificate game so bear with me here: ... IIS box and named it 'www'. ... certificate services on the IIS box (at which point it issued it's own 'root ... CA' cert to itself, or so I've managed to ascertain) and then browsed to my ...
    (microsoft.public.win2000.security)
  • Re: PKI - How do I go about chaining my root CA to a commercial CA?
    ... You *could* look into our Root CA program: ... > You can generate any kind of self-signed cert you wish (for SSL server, ... > worth the effort buying a commercially issued cert. ... > In a closed enterprise, it is common for the enterprise to have a fairly ...
    (microsoft.public.security)