-1

I'm not well versed on SSL certificates and how to install them in your environment, we have always outsourced this but I am interested in getting a full understanding and being capable of doing this myself.

Let me first state that we have an externally hosted website that uses the same domain name as our internal network. i.e. website is www.domain.com, internal network is domain.com.

The website already has a GEOTRUST SSL Certificate (not wildcard) and sometime ago I did contact them regarding how to combine this with the services we require covering on our network and to get a quote. I think we came to the conclusion the number of domains secured were already taken and we'd have to change to a different certificate and while our website requires a reputable provider for payments etc, the higher price we did not deem to be required for covering internal services we currently have covered by a self signed certificate, does that sound acceptable?

We want to get rid of that unsafe/proceed warning whenever using OWA/RDS Portal externally, and there is also a certificate warning every time a user connects to Outlook or a Server when connected by VPN.

We do multiple bt infinity lines with multiple static IPs for failover i.e. mail.domain.com/owa, mail2.domain.com/owa

So can we just purchase a wildcard SSL certificate to avoid having to declare all of the hostnames?

I have been looking at 123 reg

https://www.123-reg.co.uk/ssl-certificates/wildcard-ssl-certificates.shtml

There are 3 Wildcard Packages at £80, £175, £225, would you deem any of these acceptable for our requirements? any other recommendations

Could you please list all of the places that this certificate would to be installed/configured within our environment? Exchange? IIS? (all servers with IIS installed?)

Exchange 2010 is on its own server and so is the RD Web Environment.

Can you see any potential pitfalls I need to be aware of?

Thanks in advance

1
  • Having two servers share the same wildcard certificate mans it will be possible for an attacker to hijack connections intended for one of the two servers and direct them to the other. Whether that will open you up to any attacks depend on how you configure those two servers.
    – kasperd
    Feb 5, 2016 at 23:08

1 Answer 1

1

First - there are a lot cheaper places for SSL certificates than most of the UK vendors. They all resell the same stuff. Buy in US dollars and things get a lot cheaper. https://certificatesforexchange.com/

Wildcard certificates can work in certain scenarios. Tended to keep away from them for Exchange though as some clients can have problems with them.

However the first thing I would suggest is that you keep the public facing certificate for ecommerce separate. That will allow you to revoke either an internal use certificate or external certificate without affecting the other.

To start you need to look at the different services and what host names you are using. Go through what host names you are using externally. If you are using the same domain everywhere, so example.com, then you can probably get away with a wildcard SSL certificate. It really only needs to on public facing web services. You don't need to put a trusted certificate on each RDP server unless they are public facing (and an RDP gateway avoids that). If your internal domain was example.local, then putting an example.com certificate can actually cause you more problems than it resolves!

For Exchange, things can get complicated very quickly. Autodiscover is where the problems come. If everyone has @example.com as their primary email address, then you are fine, however if you have example.co.uk, example.de and example.fr, then you will have to take some care over the name space planning, and I would treat that separately. You also need to ensure that all of the URL configuration within Exchange is setup correctly. I have a guide on the changes required: http://semb.ee/hostnames2010

As with many things, it is all about the planning - if you don't plan then it can get out of hand very quickly.

0

Not the answer you're looking for? Browse other questions tagged .