quote:

ORIGINAL: gary1218

Well, I needed two certs.
In Microsoft's article:" Troubleshooting SSL Certificates in ISA Server 2004 Publishing", it states "The name of the certificate on the ISA Server computer must match the name that external clients will specify to reach the published Web site." and in the same article, referring to HTTPS to HTTPS connections, it states "...the name of the certificate on the IIS Web site of the published server must match the name by which ISA Server identifies the Web server", thereby implying that you need two certs. And, in Microsoft's article "Publishing Multiple Web Sites using a Wildcard Certificate in ISA Server 2004", it describes the method of using the Wildcard cert, then replacing the Wildcard cert with the internal common name cert on the internal Web server. We were receiving the 500 error regarding the "Target Principal Name" Using a Hosts entry didn't work to correct this problem, I tried that.
I read this article AFTER I discovered that the two certs worked. I then changed and issued the Wildcard cert on the ISA server so I wouldn't have to create a new listener on the ISA every time.
The reason is; we have a single solid DNS structure internally with a different internal domain name (internalcompany.org) than external public domain name (externalcompany.org), which initially had no public servers hosted from our network. This design was the prevailing wisdom at the time we implemented Windows 2000 Active Directory and is the same as (I'm certain), 99.98745% of the companies out there.
Thanks for your reply!
HTH
Gary

quote:

ORIGINAL: tonygauderman

Gary,

I am in the same boat is you as far as internal versus external domains...

Here is how I set up my DNS.  Depending on how many external hosts you have, this may be cumbersome for you, but it works for me!

Internal AD domain, internalcompany.org set up in DNS.

Second Zone create for externalcompany.org, with entries for hosts on the internet and whatever hosts exist internally.  This allows me to browse internal hosts by their external host name so that employees can access resources by the same name whether they are on the road or at work.

So, when I host www.externalcompany.org on my DMZ let of my ISA server, I create an A record on our external DNS servers for the internet IP address and an A record on our internal DNS servers for the DMZ IP address.  The ISA server points to the internal DNS server for name resolution.  Now, when I publish SSL sites, I initially install the SSL cert on my web server, then export it and install it on the listener in ISA and publish the server from the DMZ to the internet.  Since the client on the internet resolves the www.externalcompany.org to the listener on ISA, and ISA resolves www.externalcompany.org to the DMZ IP Address, the certificate is valid for both the original client AND the ISA server and works fine.

In any case, your solution of the wild card cert works great too as long as you have a single domain (I am not so lucky).

Tony