Forum Discussion

mes's avatar
mes
Level 2
13 years ago

Questions about publishing OWA external URL - Enterprise Vault

Hello Members,

Enteprise Vault 9.0.2

In publishing OWA external URL

1.       Can we use a wild card SSL Certificate?

2.       If we cannot use a wild card certificate on the EV server what does the common name of the ssl cert need to be? 
Does it need to match the external DNS A record name?

Thank you for your help.

Configuring
Enterprise Vault
Information Governance
Installing
Integration
Tip-How to
Training
  • Maverik's avatar
    Maverik
    13 years ago

    Hi,  

    The answer is yes a wildcard can be used, but it requires a good understanding of how EV works with OWA and how exactly it will be configured would depend on if you are using ISA etc and utilizing web publishing rules etc. How you then intend to secure exchange/EV using some of the more complex configurations that can be used with ISA.  Another factor could be if you are using Exchange 2003 or Exchange 2007/2010 as 2003 proxies through the Exchange Servers, 2007/2010 require direct access.  A simple scenrario would be as follows. All in all rather than an EV thing or even Exchange, it is a IIS/Firewall/DNS thing :-) if that makes sense.  

    - Cisco PIX with 2 X external IP addresses 61.10.20.100 & 61.10.20.101

    - Exchange 2010 1 X CAS Server 1 (IP Address 10.0.0.10) & 1X MBX Server (IP Address 10.0.0.11)

    - 1 X EV9 Server (IP address 10.0.0.12)

    - External Domain Names registered.

    EV.Company.Com = 61.10.20.101

    OWA.Company.Com = 61.10.20.100 

    On the CAS Server as per the EV Instructions the externalwebappURL value in web.comnfig is configured to EV.Company.Com.

    The wildcard is configured as *.company.com and applied to both CAS and EV Server in IIS. Enterprise Vault virtual directory on the EV Server is configured for HTTPS/SSL but not enforcing this to allow for internal HTTP traffic requests still. The firewall is still securing the requests as it only allows HTTPS/SSL traffic through to the EV Server and CAS Server. Alternately you coul force all traffic to this virtual directory to be SSL/HTTPS to add an extrac layer of security, however this would require other changes to EV which is another story.  

    If you decide to not use a wildcard then the common name as you say will be the external DNS A record or in the example above it will be ev.company.com

7 Replies

Sort By
  • aschnarrs's avatar
    aschnarrs
    Level 4
    13 years ago

    Reading through the document you linked, it doesnt mention if a wild card certificate can be used and it doesn't mention anything about common name in the certificate either.  Anymore thoughts?

  • LCT's avatar
    LCT
    Level 6
    13 years ago

    I am not sure I understand your question(s).

    Are you asking about publish OWA i.e. publishing your exchange CAS server externally or are you asking about publishing the EV server externally? They are two separate publishings and they are independent of each other.

    Do you currently have OWA published already? If so, how is it being published i.e. via an ISA/TMG server?

  • Maverik's avatar
    Maverik
    Level 6
    13 years ago

    Hi,  

    The answer is yes a wildcard can be used, but it requires a good understanding of how EV works with OWA and how exactly it will be configured would depend on if you are using ISA etc and utilizing web publishing rules etc. How you then intend to secure exchange/EV using some of the more complex configurations that can be used with ISA.  Another factor could be if you are using Exchange 2003 or Exchange 2007/2010 as 2003 proxies through the Exchange Servers, 2007/2010 require direct access.  A simple scenrario would be as follows. All in all rather than an EV thing or even Exchange, it is a IIS/Firewall/DNS thing :-) if that makes sense.  

    - Cisco PIX with 2 X external IP addresses 61.10.20.100 & 61.10.20.101

    - Exchange 2010 1 X CAS Server 1 (IP Address 10.0.0.10) & 1X MBX Server (IP Address 10.0.0.11)

    - 1 X EV9 Server (IP address 10.0.0.12)

    - External Domain Names registered.

    EV.Company.Com = 61.10.20.101

    OWA.Company.Com = 61.10.20.100 

    On the CAS Server as per the EV Instructions the externalwebappURL value in web.comnfig is configured to EV.Company.Com.

    The wildcard is configured as *.company.com and applied to both CAS and EV Server in IIS. Enterprise Vault virtual directory on the EV Server is configured for HTTPS/SSL but not enforcing this to allow for internal HTTP traffic requests still. The firewall is still securing the requests as it only allows HTTPS/SSL traffic through to the EV Server and CAS Server. Alternately you coul force all traffic to this virtual directory to be SSL/HTTPS to add an extrac layer of security, however this would require other changes to EV which is another story.  

    If you decide to not use a wildcard then the common name as you say will be the external DNS A record or in the example above it will be ev.company.com

  • Percy_Vere's avatar
    Percy_Vere
    Level 6
    13 years ago

    Hi, no you can't add more than one URL but you could do that via DNS by creating alias'. i.e CNAME records.

  • mes's avatar
    mes
    Level 2
    13 years ago

    Thank you both to KeyPlayer and Percy Vere for answering my questions!