Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Apologies for a long question:

We've taken on a new client whose web hosting was previously on their in-house server which still has their Exchange/Outlook email.

We now host their domain (and many others) on our server.

They're complaining that they're getting errors in Outlook. I don't understand the AutoDiscover stuff at the root of the problem, but believe that I just need to stop the SSL certificate on our server being returned when requested at a particular domain:

Yes it is, the issue lies with "{newclient}.com" being pointed to your server IP and that server has Port 443 open with an SSL certificate associated to it.

So when Outlook/ActiveSync use autodiscover to find the mailbox settings it find your SSL (because 443 is open) and flags it as an error.

The solution is to close 443 so its not discovered, Autodiscover will then proceed to mail.{newclient}.com via the MX / ServiceRecords and discover the correct SSL.

I'm new here and there was no hand-over, so I don't know whether other currently hosted sites need to accept SSL connections, though I suspect some will, or may in future.

This is a live server, so I can't risk trying loads of options in case I take the server offline!

I feel like I should be adding something like the following to vhosts.conf.

<VirtualHost *:443>
    ServerName {newclient}.com
    ServerAlias www.{newclient}.com
    SSLEngine Off
    SSLCertificateFile {NONE}
    SSLCertificateKeyFile {NONE}
</VirtualHost>

Apologies for the fact that I don't know enough about this subject to be able to ask the question more clearly!

share|improve this question

1 Answer 1

up vote 1 down vote accepted

As explained Here, a server being contacted via https cannot guess before sending its certificate what domain name the client wants to talk to.

In your case you will need either to close HTTP/443 by stopping listening at this port, or to dedicate an IP address to this customer.

I also don't know how their autodiscover stuff works, maybe you can tell outlook no to try to connect to the 443 with a DNS record...

share|improve this answer
    
Thanks. I'd hoped I was wrong about this. –  jezmck Jul 2 '13 at 21:50
    
Actually, it's possible to choose the server certificate to return before any HTTP traffic using Server Name Indication, which is increasingly supported. (The biggest non-supporters are IE on XP and a number of mobile phones.) –  Bruno Jul 9 '13 at 14:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.