2

I correctly bought a SSL certificate for my domain www.omniservice2.it from Aruba Business on my server with Windows Server 2012 R2.

I correctly installed the certificate in IIS 8 on every site and web application and in fact each of them is correctly reachable from https.

Now, I need to set up the same for my SMTP server in IIS 6. The SMTP works fine with Basic Authentication but obviously I want the credentials to be encrypted. So, I activated the flag "Requires TLS Encryption" in Tab Access under its properties.

Moreover, in the root console I did the following to check the certificate is installed in Personal store (otherwise IIS 6 won't detect it as documentation says) File --> Add/Remove snap-in --> Select Certificates --> Computer account --> Local computer --> OK Under Console Root I see Certificates (Local Computer) --> Personal --> Certificate into which there is correctly the RapidSSL SHA256 CA I bought with the correct expiration date.

The problem is that in section "Secure Communication" I still read "TLS is not available without a certificate" Where also am I supposed to install that certificate so that IIS 6 detects it?

Improve this question
5
  • I am looking at the same thing just right now. What kind of certificate do got installed and what is the Subject? is it also a wildcard certificate for the domain (i.e. *.you.domain.com?) or a specific one for your server?
    – Marcos Soutullo
    Jun 26, 2017 at 18:39
  • Mine is not a wildcard certificate, but it's a specific certificate for my domain, linked to our production server and its DNS name. At the moment I cannot remember how I resolved this issue, and I'm not even sure it was the real correct way, as nobody replied to me on this Q&A as always. Anyway, I made an error in the snap-in of the console. Something linked to the name/subject of the certificate. I had written https://www.mydomain.it instead of www.mydomain.it, that's why it did not recognize it. if you want I can have a look in our production server tomorrow in the morning in office
    – Lory Lory
    Jun 26, 2017 at 18:50
  • Ouh, many thanks for your quick answer! well, I've just imported a wildcard SSL certificate (*.my.domain) to the certificates snap-in (put specifically under the personal folder) and I'm able to tick 'require TLS encryption' in the Access tab after clicking in properties (IIS 6.0 manager).
    – Marcos Soutullo
    Jun 26, 2017 at 18:57
  • I'm gonna try to capture some data using tcpdump or similar (wireshark) just to verify whether in fact, the credentials are being exchanged in such a secure way!
    – Marcos Soutullo
    Jun 26, 2017 at 18:58
  • Ok, maybe I didn't get what was your issue. Anyway, if you want to test your secure smtp, you could try this site https://www.checktls.com which was advised to my also by my server provider..
    – Lory Lory
    Jun 26, 2017 at 19:08

1 Answer 1

Reset to default
1

From https://forums.iis.net/t/1155280.aspx

When the IIS6 SMTP Server module looks for a certificate to use for TLS encryption, it seems checks the 'Local_Machine\my' store. I'm not sure where the OpenSSL certificate was placed by the system, but if it's not in the Personal certificates section, then the SMTP server won't be able to find it, and will therefore provide the error listed here.

If you have IIS7 installed on this server, the easiest way to go about securing this would be to select the 'Server' node in the IIS7 manager, select 'Certificates', and 'Create a self-signed certificate...' This will place a copy of the certificate in both the 'Local_Machine\my' store, as well as the Trusted Roots store.

I ran through a quick test of this: clearing out the Personal store provided the error mentioned above, but reloading the 'Properties' of the SMTP server after creating the self-signed certificate through IIS showed the certificate present, and allowed it to be secured.

Hope this helps!

Note: To check what's in a given certificate store, load up MMC (mmc.exe in the 'Run' box), under 'File', select 'Add/Remove Snap-in'. Under the snap-in list, select 'Certificates', and then choose Local Machine. Once back at the MMC listing, under certificates, you can check 'Personal\Certificates' to see its content.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .