5

We are currently transitioning our site to use HTTPS everywhere, and this includes the emails that we send to customers. On our internal testing environments, we are using IIS with SSL certificates signed by our own company-internal CA. This CA is implicitly trusted by having its cert installed into the Local Computer > Trusted Root Certification Authorities certificate store on all machines.

However, in any email we generate that contains links to images from servers using our self-CA-signed certs, those images show up as the standard missing images/red X in Outlook 2013. If I choose Actions > View in Browser in Outlook, IE opens the message with the images displayed correctly.

We've tried numerous things: the "Do not save encrypted pages to disk" setting, the Group Policy setting for the same, and various other hints and tips I've found via Google - none of which have made any difference.

Basically it seems that Outlook is refusing to trust our cert, even though its CA is trusted - almost as if it's using its own internal list of trusted CAs and not the local machine's. Is this the case and is there any way around this behaviour? If not, why is this happening and what can I do to get around it?

14
  • What happens when using HTTP? Outlook by default doesn't download images, this could very well be unrelated to HTTPS. Also, you should have another button in Outlook to show images (without using an external browser): what happens if you click it?
    – Massimo
    Oct 13, 2016 at 9:58
  • 1
    @Massimo HTTP images works fine, Outlook's "show images" works fine with HTTP, as soon as he images are served over HTTPS Outlook refuses to show them.
    – Ian Kemp
    Oct 13, 2016 at 10:46
  • 1
    @RicardoC The HTTPS images aren't displayed even if I choose to show the images.
    – Ian Kemp
    Oct 14, 2016 at 15:34
  • 1
    @Sum1sAdmin he can see them in the browser, he is having issues seen them inside the body of the email in Outlook
    – Ricardo C
    Oct 14, 2016 at 15:55
  • 1
    @Sum1sAdmin As stated, these are internal testing environments. They cannot be accessed from the Internet.
    – Ian Kemp
    Oct 15, 2016 at 12:26

1 Answer 1

-1

Globally valid Comodo certs are $9 from Namecheap. If you work for minimum wage (I'm betting you don't) and you've spent more than hour on this it's not worth your time. You might be able to "fix" your internal clients, but when mailing anyone outside your organization your images will be varying levels of broken.

5
  • 1
    Actually you don't even have to pay anymore: letsencrypt.org . It's free, you can fully automate / provision certificates and is supported by all (google / mozilla / facebook / whatever).
    – Fredi
    Oct 13, 2016 at 15:32
  • 1
    Our production, public-facing websites have Thawte certificates and Outlook works fine with images from those. We can't use third-party certs on our internal environments because they (a) aren't exposed to the internet (b) use a custom (non-IANA) TLD.
    – Ian Kemp
    Oct 14, 2016 at 6:29
  • @Fredi, I'm aware of Let's Encrypt but I didn't recommend it because he's using IIS. I haven't seen a good way to integrate LE with IIS yet.
    – user96232
    Oct 14, 2016 at 12:28
  • do you mean besides using nginx, haproxy, apache, or any other reverse proxy (as you should) Oct 15, 2016 at 2:03
  • @JacobEvans We're using Microsoft's ARR as a reverse proxy.
    – Ian Kemp
    Oct 15, 2016 at 12:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .