2

I'm making a new Ex2010 environment. Yes, the client knows about Exchange 2013.

I have a Netscaler up-front for access from outside, but it's only in the DMZ, not available from the inside. I can configure the Netscaler to handle SSL Offload, but can I still also use SSL on the inside afterwards? I know to make SSL Offload work, I have to disable the requirement for SSL on all the IIS sites and VirDirs, etc. But there's a few steps where you go into web.config (for EWS and Autodiscover) and mangle the files to replace https with http.

I would prefer to continue using HTTPS for any connections that aren't coming from the Netscaler. Is that possible, or is this an only-one-or-the-other situation, from the POV of the Exchange CAS servers?

... Or, does this even matter much? All internal Outlook connections will be MAPI, if the clients fail over to Outlook Anywhere they'll be hitting the Netscaler anyway. Except for maybe autodiscover. Hm.

Improve this question
4
  • 1
    Out of curiosity - why does the client want to offload SSL at all? Wouldn't it be much easier to just let the Exchange servers do the HTTPS termination, since they don't have an internal LB?
    – pauska
    Aug 1, 2014 at 18:36
  • All of the Netscaler guides for this are using SSL offload, and since I can use it, I figure "why not?" Except for this detail. If I can't solve this problem/answer this question, then I will be simply using HTTPS as you suggest.
    – mfinni
    Aug 1, 2014 at 18:38
  • Additionally, a lot of the Netscaler configs as written are dependent on SSL Offload.
    – mfinni
    Aug 1, 2014 at 18:41
  • I see. It's a shame that the client doesn't want to use Exchange 2013, as it works wonderful with a single namespace (and thus internal clients could have used the DMZ LB connection). I really have no idea how to solve this one, so good luck.
    – pauska
    Aug 1, 2014 at 18:46

1 Answer 1

Reset to default
0

Aha. http://social.technet.microsoft.com/wiki/contents/articles/1267.how-to-configure-ssl-offloading-in-exchange-2010.aspx

After 2010 SP1, Exchange no longer requires mangling of the web.config file to disable SSL, so you can simply remove the requirement for SSL on all of the websites/VirDirs for Exchange, which still allows connections via HTTPS internally.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .