Welcome to ISAserver.org

SSL Issue with ISA on Windows 2003 Server

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2000 General] >> Web Publishing >> SSL Issue with ISA on Windows 2003 Server

Page: [1]

Message

<< Older Topic Newer Topic >>

SSL Issue with ISA on Windows 2003 Server - 13.Jan.2004 8:13:00 AM

Yaniel

Posts: 3
Joined: 3.Dec.2003
From: Perth, Australia
Status: offline

I am trying to move some SSL base Web Publishing rules from an ISA server running Windows Server 2000 to another ISA Server running Windows 2003 Server on my DMZ.

I have exported all certificates including the root certificates (the CA is internal), and imported onto the new server. I have checked that the certificate is valid and the server believes it can validate it's root certificate.

I have configured the Web Publishing Rule as per to old server, moved the IP Address to the new server and configured the listener in ISA to use the correct ceritifcate.

When I try to connect from a client I am told the Certificate Chain is not valid. If I try to connect to the destination web server from the ISA box, I receive an error : "Revocation information for the security certificate for this site is not available. Do you want to proceed?"

This seems to be an additional security feature in Windows 2003 Server. Does anyone know how I can get around it, given that I can not make the CA visible to the ISA Server to allow it to get the CRL form the CA.

Cheers,

James.

Post #: 1

Featured Links*

RE: SSL Issue with ISA on Windows 2003 Server - 14.Jan.2004 3:19:00 AM

tshinder

Posts: 47659
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi James,

I'm not sure what you mean by trying to connect from the ISA firewall.

Is this a Web Publishing issue or an outbound access issue from the ISA firewall?

Thanks!
Tom

(in reply to Yaniel)

Post #: 2

RE: SSL Issue with ISA on Windows 2003 Server - 19.Jan.2004 8:58:00 AM

Yaniel

Posts: 3
Joined: 3.Dec.2003
From: Perth, Australia
Status: offline

Tom,

This is a web publishing issue.

In the past to ensure that I have the certificate chain in place I have connected to the internal web server (the one being published) from the ISA server using IE as a test. If this connected without any prompts, the publishing would work. If it prompted (normally because the certificate chain was not right), connecting via the publishing rule would not work.

In this case I have checked the root certificate is in place and all seems well, but I get this error saying that it could not find the revocation information for the certificate. I have not seen this error on the old ISA server.

James.

(in reply to Yaniel)

Post #: 3

RE: SSL Issue with ISA on Windows 2003 Server - 19.Jan.2004 1:23:00 PM

tshinder

Posts: 47659
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi James,

OK, I think I get it [Smile]

I haven't seen this error. Is the date correct on the certificate? Is the date correct on all the machines participating in the communication? By default, the browser and the ISA server do not check for the CRL.

Thanks!
Tom

(in reply to Yaniel)

Post #: 4