5

I have an Exchange 2003 deployment and cannot get rpc over http to work. I have followed all of the mirosoft docs but it is not working. I can see the traffic coming in over the firewall. However the clients cannot connect. Are there any hotixes from microsoft that I need to add in to get this to work?

6 Answers 6

3

If your client doesn't trust the certificate the website is using, it will silently drop the connection without even a hint there's some error.

Try connecting from that client to your Exchange's OWA: if Internet Explorer complains about an invalid certificate, that's your problem.

You can solve it by creating a valid certificate (if you have a certification authority available) or by importing the existing certificate in your client's machine store.

2

I've recently deployed rpc over http in our environemnt. My first piece of advice is to assure you that black magic isn't required to make it work. The rpc over http feature works as advertised, is well documented and stable. There is no need for hotfixes or odd workarounds.

I think the first step to diagnosing your issue is to detail your deployment scenario. For instance is it a Front-End / Back-End architecture, are you offloading ssl, are you authencticating requests in the perimeter network, is there a locally connected global catalog serevr, etc. This will give clues to where it's failing down and I can detail a list of configuration steps to check.

If I had to guess where the issue(s) may lie it's in two areas - certifcates and authentication. As suggested by others on the certifcate front make sure you use valid and trusted certifcates on the rpc proxy and on the web publishing rule (if your using ISA or a similiar product).

On the authentication front Microsoft recommend you use 'Basic' authentication over SSL, especially if you are using ISA server for authentication. If you want to use NTLM authentication I believe ISA server can only pass through and not delegate authentcation credentials. This will be the case for many reverse proxy products. I recommend checking that authentication scheme you want to use is applied consistantly on your Front-End server and firewall.

For testing on the client side you can use a combination of registry keys and the command 'Outlook /rpcdiag" for force Outlook to connect via HTTP instead of TCP. Also the Exchange Server Remote Connectivity Analyser is a valuable diagnostic tool.

1
  • 1
    Another vote for the Connectivity Analyser Tool - at least you know for sure that it is working! It doesn't like self signed certs though :( Jun 22, 2009 at 6:16
1

Are you using https and a self signed certificate?

If so you will need to manually add it to the certificate stores on the client PCs. This can be done by running certmgr.msc and importing it into 'Trusted Root Certification Authorities'.

1

See http://www.ratsauce.co.uk/notablog/SettingupOutlookRPC.asp for my notes on Outlook Anywhere. The procedure described has been tested by me and many others and I know it works!

JR

0

What is the actual problem, ie what happens on the client side? In Outlook 2003+ I think you can hold ctrl and right-click the tray icon to gain access to the connection status window - which will show you what is happening. Are connections being tryed over anything but HTTPS?

Have you configured the actual mail server part in Outlook for the internal name (ie not the public facing proxy address you specify in the outlook anywhere settings)? How is this service published by the firewall (and what firewall is it?)?

Sadly there's so many parts to this setup that it's hard to pinpoint without more information - but the answers with detailed guides should provide enough help to get through it.

0

As other posters have said, this is likely a certificate problem. Make sure the certificate is added to the clients if it is self signed.

If you are using ISA as your firewall, you are actually proxying the RPC server, so the server for the exchange server needs to be installed on the ISA server as well, and it needs to present this cert instead of its own.

IIRC, your clients need to be Outlook 2003 or higher, and Outlook 2003 needs to be SP1 or higher. Petri has a great tutorial that helped me at a past job.

You must log in to answer this question.