Posted on Thu, Sep 01, 2011
Starting with Exchange 2007 and Outlook 2007, client connections to the server are encrypted using SSL technology. This requires a valid certificate be installed on the Exchange server or the Outlook client will warn the user each time they open Outlook. By default, Exchange installs a self-signed certificate during installation which will be automatically valid for any Outlook clients connecting from computers within the same domain as the server. However, if you plan to set up remote users with Outlook using RPC over HTTPS (also known as Outlook Anywhere), the the users internet-facing Client Access Server will require an externally valid SSL certificate. In situation where a company only has one Exchange server handling all roles, this quickly becomes a problem. Once the externally valid certificate is installed on the Exchange server, all internal clients on Outlook 2007 or later will receive a certificate error each time Outlook is opened. This is because the Exchange server is presenting itself to the clients with its valid internal network name (e.g. exchange.company.local), while the certificate shows its valid external name (e.g. mail.company.com). This conflict is the source of the Outlook warning.
The simplest way to circumvent this issue is to purchase a mutli-domain certificate, which will be valid for both the external and internal name of the server. There are two major downsides to this, however. One is cost. Multi-domain certificates are significantly more expensive than standard, single name certificates. The second downside is that the certificate will contain the internal name of the server and the certificate will be available publicly for anyone to see. This can be a security liability, exposing internal network information to anyone who cares to look.
The better solution is to modify the Exchange server to use *only* the external server name when making connections to clients. This allows a single name certificate to be used to secure all connections made by the server and ensures the server will only ever refer to itself by this chosen external name. The steps to accomplish this are somewhat complex, but thankfully, some great people have written Powershell scripts which execute the necessary commands for both Exchange 2007 and Exchange 2010. Using these scripts automatically changes the name used both internally and externally by all virtual directories as well as the SCP on the server.
Below are copies of the scripts for both Exchange 2010 and Exchange 2007.
Brian St. Marie - Sr. Systems Engineer
========================================================
Exchange 2007 Credit to Exchange Ninjas (http://www.exchangeninjas.com/set-allvdirs)
========================================================
# Script to allow you to set all virtual directories to a common name like mail.company.com
Start-Transcript
# Variables
[string]$UMExtend = '/UnifiedMessaging/Service.asmx'
[string]$OABExtend = '/OAB'
[string]$SCPExtend = '/Autodiscover/Autodiscover.xml'
[string]$EWSExtend = '/EWS/Exchange.asmx'
[string]$ConfirmPrompt = 'Set this Value? (Y/N)'
[string]$NoChangeForeground = 'white'
[string]$NoChangeBackground = 'red'
Write-host 'This will allow you to set the virtual directories associated with Autodiscover provided services to the name you provide.'
Write-host ''
[string]$base = Read-host 'Base name of virtual directory (e.g. mail.company.com)'
write-host ''
# =======================================================
# Validate if a third party trusted certificate is being used
# because BITS won't use untrusted certificates
[string]$set = Read-host 'Is the certificate being used an internally generated certificate? (Y/N)'
Write-host ''
if ($set -eq 'Y') {
[string]$OABprefix = 'http://'
} else {
[string]$OABprefix = 'https://'
}
# =======================================================
# Build the Autodiscover URL and set the SCP Value
Write-host 'Setting Autodiscover Service Connection Point' -foregroundcolor Yellow
write-host ''
$SCPURL = 'https://' + $base + $SCPExtend
[array]$SCPCurrent = Get-ClientAccessServer
Foreach ($value in $SCPCurrent) {
Write-host 'Looking at Server: ' $value.name
Write-host 'Current SCP value: ' $value.AutoDiscoverServiceInternalUri.absoluteuri
Write-host 'New SCP Value: ' $SCPURL
[string]$set = Read-host $ConfirmPrompt
write-host ''
if ($set -eq 'Y') {
Set-ClientAccessServer -id $value.identity -AutoDiscoverServiceInternalUri $SCPURL
} else {
write-host 'Autodiscover Service Connection Point internal value NOT changed' -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
}
# =======================================================
# Build the EWS URL and set the internal Value
Write-host 'Setting Exchange Web Services Virtual Directories' -foregroundcolor Yellow
write-host ''
$EWSURL = 'https://' + $base + $EWSExtend
[array]$EWSCurrent = Get-WebServicesVirtualDirectory
Foreach ($value in $EWSCurrent) {
Write-host 'Looking at Server: ' $value.server
Write-host 'Current Internal Value: ' $value.internalURL
Write-host 'New Internal Value: ' $EWSUrl
[string]$set = Read-host $ConfirmPrompt
write-host ''
if ($set -eq 'Y') {
Set-WebServicesVirtualDirectory -id $value.identity -InternalURL $EWSURL
} else {
write-host 'Exchange Web Services Virtual Directory internal value NOT changed' -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
Write-host 'Looking at Server: ' $value.server
Write-host 'Current External Value: ' $value.externalURL
Write-host 'New External Value: ' $EWSUrl
[string]$set = Read-host $ConfirmPrompt
write-host ''
if ($set -eq 'Y') {
Set-WebServicesVirtualDirectory -id $value.identity -ExternalURL $EWSURL
} else {
write-host 'Exchange Web Services Virtual Directory external value NOT changed' -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
}
# ======================================================
# Build the OAB URL and set the internal Value
Write-host 'Setting OAB Virtual Directories' -foregroundcolor Yellow
write-host ''
$OABURL = $OABprefix + $base + $OABExtend
[array]$OABCurrent = Get-OABVirtualDirectory
Foreach ($value in $OABcurrent) {
Write-host 'Looking at Server: ' $value.server
Write-host 'Current Internal Value: ' $value.internalURL
Write-host 'New Internal Value: ' $OABUrl
[string]$set = Read-host $ConfirmPrompt
write-host ''
if ($set -eq 'Y') {
Set-OABVirtualDirectory -id $value.identity -InternalURL $OABURL
} else {
write-host 'OAB Virtual Directory internal value NOT changed' -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
Write-host 'Looking at Server: ' $value.server
Write-host 'Current External Value: ' $value.externalURL
Write-host 'New External Value: ' $OABUrl
[string]$set = Read-host $ConfirmPrompt
write-host ''
if ($set -eq 'Y') {
Set-OABVirtualDirectory -id $value.identity -ExternalURL $OABURL
} else {
write-host 'OAB Virtual Directory external value NOT changed' -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
}
# =======================================================
# Build the UM URL and set the internal Value
Write-host 'Setting UM Virtual Directories' -foregroundcolor Yellow
write-host ''
$UMURL = 'https://' + $base + $UMExtend
[array]$UMCurrent = Get-UMVirtualDirectory
foreach ($value in $UMCurrent) {
Write-host 'Looking at Server: ' $value.server
Write-host 'Current Internal Value: ' $value.internalURL
Write-host 'New Internal Value: ' $UMUrl
[string]$set = Read-host $ConfirmPrompt
write-host ''
if ($set -eq 'Y') {
Set-UMVirtualDirectory -id $value.identity -InternalURL $UMURL
} else {
write-host 'UM Virtual Directory internal value NOT changed' -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
Write-host 'Looking at Server: ' $value.server
Write-host 'Current External Value: ' $value.externalURL
Write-host 'New External Value: ' $UMUrl
[string]$set = Read-host $ConfirmPrompt
write-host ''
if ($set -eq 'Y') {
Set-UMVirtualDirectory -id $value.identity -ExternalURL $UMURL
} else {
write-host 'UM Virtual Directory external value NOT changed' -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
}
Stop-Transcript
========================================================
Exchange 2010 Credit to Barry Martin (http://virtualbarrymartin.me/2009/12/29/how-to-setup-exchange-2010-to-use-a-single-certificate-for-internal-and-external-use/)
========================================================
# Script to allow you to set all virtual directories to a common name like mail.company.com
Start-Transcript
# Variables
[string]$UMExtend = “/UnifiedMessaging/Service.asmx”
[string]$OWAExtend = “/OWA”
[string]$OABExtend = “/OAB”
[string]$SCPExtend = “/Autodiscover/Autodiscover.xml”
[string]$EWSExtend = “/EWS/Exchange.asmx”
[string]$ECPExtend = “/ECP”
[string]$ConfirmPrompt = “Set this Value? (Y/N)”
[string]$NoChangeForeground = “white”
[string]$NoChangeBackground = “red”
Write-host “This will allow you to set the virtual directories associated with setting up a single SSL certificate to work with Exchange 2010.”
Write-host “”
[string]$base = Read-host “Base name of virtual directory (e.g. mail.company.com)”
write-host “”
# =======================================================
# Validate if a third party trusted certificate is being used
# because BITS won’t use untrusted certificates
[string]$set = Read-host “Is the certificate being used an internally generated certificate? (Y/N)”
Write-host “”
if ($set -eq “Y”) {
[string]$OABprefix = “http://”
} else {
[string]$OABprefix = “https://”
}
# =======================================================
# Build the Autodiscover URL and set the SCP Value
Write-host “Setting Autodiscover Service Connection Point” -foregroundcolor Yellow
write-host “”
$SCPURL = “https://” + $base + $SCPExtend
[array]$SCPCurrent = Get-ClientAccessServer
Foreach ($value in $SCPCurrent) {
Write-host “Looking at Server: ” $value.name
Write-host “Current SCP value: ” $value.AutoDiscoverServiceInternalUri.absoluteuri
Write-host “New SCP Value: ” $SCPURL
[string]$set = Read-host $ConfirmPrompt
write-host “”
if ($set -eq “Y”) {
Set-ClientAccessServer -id $value.identity -AutoDiscoverServiceInternalUri $SCPURL
} else {
write-host “Autodiscover Service Connection Point internal value NOT changed” -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
}
# =======================================================
# Build the EWS URL and set the internal Value
Write-host “Setting Exchange Web Services Virtual Directories” -foregroundcolor Yellow
write-host “”
$EWSURL = “https://” + $base + $EWSExtend
[array]$EWSCurrent = Get-WebServicesVirtualDirectory
Foreach ($value in $EWSCurrent) {
Write-host “Looking at Server: ” $value.server
Write-host “Current Internal Value: ” $value.internalURL
Write-host “New Internal Value: ” $EWSUrl
[string]$set = Read-host $ConfirmPrompt
write-host “”
if ($set -eq “Y”) {
Set-WebServicesVirtualDirectory -id $value.identity -InternalURL $EWSURL
} else {
write-host “Exchange Web Services Virtual Directory internal value NOT changed” -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
Write-host “Looking at Server: ” $value.server
Write-host “Current External Value: ” $value.externalURL
Write-host “New External Value: ” $EWSUrl
[string]$set = Read-host $ConfirmPrompt
write-host “”
if ($set -eq “Y”) {
Set-WebServicesVirtualDirectory -id $value.identity -ExternalURL $EWSURL
} else {
write-host “Exchange Web Services Virtual Directory external value NOT changed” -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
}
# ======================================================
# Build the OAB URL and set the internal Value
Write-host “Setting OAB Virtual Directories” -foregroundcolor Yellow
write-host “”
$OABURL = $OABprefix + $base + $OABExtend
[array]$OABCurrent = Get-OABVirtualDirectory
Foreach ($value in $OABcurrent) {
Write-host “Looking at Server: ” $value.server
Write-host “Current Internal Value: ” $value.internalURL
Write-host “New Internal Value: ” $OABUrl
[string]$set = Read-host $ConfirmPrompt
write-host “”
if ($set -eq “Y”) {
Set-OABVirtualDirectory -id $value.identity -InternalURL $OABURL
} else {
write-host “OAB Virtual Directory internal value NOT changed” -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
Write-host “Looking at Server: ” $value.server
Write-host “Current External Value: ” $value.externalURL
Write-host “New External Value: ” $OABUrl
[string]$set = Read-host $ConfirmPrompt
write-host “”
if ($set -eq “Y”) {
Set-OABVirtualDirectory -id $value.identity -ExternalURL $OABURL
} else {
write-host “OAB Virtual Directory external value NOT changed” -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
}
# =======================================================
# Build the UM URL and set the internal Value
Write-host “Setting UM Virtual Directories” -foregroundcolor Yellow
write-host “”
$UMURL = “https://” + $base + $UMExtend
[array]$UMCurrent = Get-UMVirtualDirectory
foreach ($value in $UMCurrent) {
Write-host “Looking at Server: ” $value.server
Write-host “Current Internal Value: ” $value.internalURL
Write-host “New Internal Value: ” $UMUrl
[string]$set = Read-host $ConfirmPrompt
write-host “”
if ($set -eq “Y”) {
Set-UMVirtualDirectory -id $value.identity -InternalURL $UMURL
} else {
write-host “UM Virtual Directory internal value NOT changed” -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
Write-host “Looking at Server: ” $value.server
Write-host “Current External Value: ” $value.externalURL
Write-host “New External Value: ” $UMUrl
[string]$set = Read-host $ConfirmPrompt
write-host “”
if ($set -eq “Y”) {
Set-UMVirtualDirectory -id $value.identity -ExternalURL $UMURL
} else {
write-host “UM Virtual Directory external value NOT changed” -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
}
# =======================================================
# Build the ECP URL and set the internal Value
Write-host “Setting ECP Virtual Directories” -foregroundcolor Yellow
write-host “”
$ECPURL = “https://” + $base + $ECPExtend
[array]$ECPCurrent = Get-ECPVirtualDirectory
foreach ($value in $ECPCurrent) {
Write-host “Looking at Server: ” $value.server
Write-host “Current Internal Value: ” $value.internalURL
Write-host “New Internal Value: ” $ECPUrl
[string]$set = Read-host $ConfirmPrompt
write-host “”
if ($set -eq “Y”) {
Set-ECPVirtualDirectory -id $value.identity -InternalURL $ECPURL
} else {
write-host “ECP Virtual Directory internal value NOT changed” -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
Write-host “Looking at Server: ” $value.server
Write-host “Current External Value: ” $value.externalURL
Write-host “New External Value: ” $ECPUrl
[string]$set = Read-host $ConfirmPrompt
write-host “”
if ($set -eq “Y”) {
Set-ECPVirtualDirectory -id $value.identity -ExternalURL $ECPURL
} else {
write-host “ECP Virtual Directory external value NOT changed” -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
}
# =======================================================
# Build the OWA URL and set the internal Value
Write-host “Setting OWA Virtual Directories” -foregroundcolor Yellow
write-host “”
$OWAURL = “https://” + $base + $OWAExtend
[array]$OWACurrent = Get-OWAVirtualDirectory
foreach ($value in $OWACurrent) {
Write-host “Looking at Server: ” $value.server
Write-host “Current Internal Value: ” $value.internalURL
Write-host “New Internal Value: ” $OWAUrl
[string]$set = Read-host $ConfirmPrompt
write-host “”
if ($set -eq “Y”) {
Set-OWAVirtualDirectory -id $value.identity -InternalURL $OWAURL
} else {
write-host “OWA Virtual Directory internal value NOT changed” -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
Write-host “Looking at Server: ” $value.server
Write-host “Current External Value: ” $value.externalURL
Write-host “New External Value: ” $OWAUrl
[string]$set = Read-host $ConfirmPrompt
write-host “”
if ($set -eq “Y”) {
Set-OWAVirtualDirectory -id $value.identity -ExternalURL $OWAURL
} else {
write-host “OWA Virtual Directory external value NOT changed” -foregroundcolor $NoChangeForeground -backgroundcolor $NoChangeBackground
}
}
Stop-Transcript
Give Us a Call 617-731-6319 and Ask a Professional IT Support Technician Any Questions You May Have!
Sincerely, Terminal We Serve All of Greater Boston and Cambridge, MA
Posted on Thu, Jul 21, 2011
Encrypted email is a pretty common term these days, but also a loaded term. People make a lot of assumptions about what it means, but as with many things in IT, things get quite a bit more complex beneath the surface.
Encryption itself is fairly self-explanatory; encryption is the act of scrambling data so only people who are supposed to read it can do so. Even if someone else gets ahold of that data, it will look like gibberish to them, unless they have the proper key to decrypt it.
So how does this apply to email? Well, there are several places in email technology where encryption is a very good thing. Some of them are more straightforward and easier to implement than others, however. We'll go over each here.
1) Email storage. The first and most obvious place to encrypt email is in your mailbox. That is to say, if someone gets on your computer, can they simply copy your entire mailbox file onto a USB drive and read it later at their leisure? If your mailbox is encrypted, it means that no one can read your email unless they can sign into it with your username and password. This type of encryption has been used with email for many years and is an option with most email programs, such as Outlook. If you use cloud email, such as with a company like Google (gmail), Rackspace, or Intermedia, the email would also be encrypted on their storage servers and to ensure that you and only you can look at the messages in your mailbox. The same applies if your email is held on a central company server like with Microsoft Exchange; your mailbox would be encrypted on the mail server in your company's data center.
2) Sending email. Email also can be encrypted in transit. This is required by many modern technology compliance standards, such as the Massachusetts Personal Information protection laws, and for good reason. Every time you send an email, it makes its way across the internet to its intended recipient. Along the way, it passes through any number of internet devices, such as routers and switches, and even other mail servers. At any point along this chain, your email can be read by anyone who happens to be looking. Yes, you read that right; your email is just like an open letter in the mail that anyone can read as it passes them by.
In order to ensure that only the person you send the email to can read it, you would need to encrypt the message. There are many technologies to make this work, but none of them are as seamless or user-friendly as might be hoped. For instance, one type of technology doesn't send the email at all, but simply sends a message to the recipient redirecting them to a webpage where they can view your secure message by using a password. Other programs work by requiring the person on the other end know a password to open the message in their inbox. Each version works well, but neither is as obvious or easy to use as basic email. Because of the added difficulty of using these kinds of technology, few companies or individuals use any kind of transit encryption, even though they may be required to do so by law.
3) Accessing email. If your email is hosted in the cloud or on a server, you also need to be concerned with how you access that email. For instance, if you access your email through a webpage, such as with a service like Gmail, each message you compose or read is being sent between you and that remote server. If the messages aren't encrypted between you and your server, then anyone sitting between each endpoint can read your messages. This is much like the example above about sending email, but it deals with the traffic between you and your server rather than the messages between you and your recipients. Fortunately, this is a much easier area to encrypt than sending emails; most email systems already encrypt email access without the end user needing to do anything differently. For example, Gmail uses HTTPS web addresses which encrypt your session with SSL technology and Outlook similarly uses SSL technology to encrypt data between itself and an Exchange server.
As you can see, "encrypted email" can mean many different things. When looking at email solutions for yourself or your company, pay particular attention to what any solution means by encrypted email; you will often find that while it may cover points 1 and 3, it provides no solution for point 2, which is the most critical of the three. This is of particular concern if your business works with personal information for your customers, such as credit card data, bank account info, social security numbers, or even phone numbers and addresses. In these cases, you may be *legally required* to encrypt all your email containing any personal information, or face stiff fines and lawsuits.
Don't leave yourself wondering just how secure your email system is; Contact Us today and let a Terminal engineer go through your email system with you and help ensure you are doing everything you can to stay secure and compliant with today’s standards.
Brian St. Marie - Sr. Systems Engineer
Give Us a Call 617-731-6319 and Ask a Professional IT Support Technician Any Questions You May Have!
Sincerely, Terminal We Serve All of Greater Boston and Cambridge, MA