Let me give you a quick overview of the kind of issue that makes it fun to be a consultant.
When you go to a web site where any personal information is going to be exchanged, you’re likely to see the web site address change from http:// to https://. The data is encrypted (has a “Secure Sockets Layer” or SSL) and is reasonably well protected against eavesdroppers. You’ll see it at banking sites or almost anything involving money or payment, as well as on web sites for access to company networks and other places where data should be confidential.
When you go to http://www.wellsfargo.com/, the bank’s web server presents its security certificate from a known certificate authority, a big company that has done some checking to ensure that the server actually belongs to the company whose name is on the web site. Your browser examines it and agrees that it looks authentic, then it does some cryptographic things that convince it that the certificate was really issued by the big trusted authority. When it’s satisfied, it proceeds automatically to https://www.wellsfargo.com/ and shows you a happy padlock icon in the address bar.
Until recently, SSL certificates were only used by big companies: they were expensive, required annoying paperwork, and the whole process was technically difficult.
Small Business Server 2003 wanted remote users to log into its great Remote Web Workplace over a secure SSL connection but couldn’t saddle small businesses with the headache of buying expensive certificates, so it used a workaround. By default an SBS 2003 server presents a “self-signed certificate.” Essentially the server vouches for itself and tells your browser that it’s safe and trustworthy.
That sounds a bit flaky but it worked well enough for a long time, until security concerns began to trump everything else. Business people began buying Windows Mobile phones to sync their Outlook folders over the air and for a while it was possible to convince them to accept the SBS server’s self-signed certificate, but it got harder and harder to accomplish – it required finding the right tool to install the certificate on the phone and the manufacturers were nervous about giving people access to the depths of the phone’s operating system to do that. Now it’s almost always impossible.
Meanwhile Microsoft began to add new security warnings to Internet Explorer as part of its hardening over the last few years. Now when you go to a site with an SBS 2003 certificate, you get this ominous warning:
If you go past the scary warning to the company’s RWW site, you get the unhappy red IE address bar instead of the happy padlock:
Fortunately, a few companies began offering inexpensive SSL certificates with a minimum of fuss. GoDaddy.com offers SSL certificates for only thirty dollars per year that are accepted by most computers, phones and other devices. SBS consultants began to work out elaborate documentation for installing them on SBS servers. Many consultants made it a standard part of setting up a server running SBS 2003.
SBS 2008 still begins with a self-signed certificate but a wizard is included in the initial setup checklist to help purchase a third-party certificate.
The wizard wasn’t helpful to me in a migration where I already had a domain name with an existing certificate. I found myself burrowing deeply into IIS and feeling my way through the process. I was successful but it took some interesting tricks to get everything to work correctly.
The experience exposed another interesting feature of Exchange 2007. If a company runs the web site http://www.bigfirm.com/, it can set up http://remote.bigfirm.com/ as a subdomain that leads to their internal company network. Set the company’s MX record for incoming mail to http://remote.bigfirm.com/ and give that address to the business people for remote access. SBS 2008 has wizards to help get the domain names registered and set up in Exchange.
Then if a business person goes home and sets up Outlook 2007 for an Exchange Server at http://remote.bigfirm.com/, Outlook will configure itself automatically with the settings to connect over the Internet to Exchange Server at the office. It’s not necessary in that case to configure the deep proxy settings that have been required until now to set up Outlook for RPC over HTTP. Microsoft thinks the technology is so cool that it blessed it with a new brand name, “Outlook Anywhere.” (SBS 2008 does some of the magic to accomplish that, thank goodness – otherwise it requires deep surgery in ADSIEDIT and the Exchange command line console.)
That works fine, I’m sure, but I used a different naming scheme when I bought domain names for all my SBS clients for their remote access. SBS 2008 does not like that arrangement one little bit. And it’s only easy to set up a subdomain and manipulate MX records if you have full DNS control over the ISP for http://www.bigfirm.com/. A small business will frequently have set up their web site with small hosting companies and web site designers that are, shall we say, not always easy to work with.
You see what I mean, I’m sure – it’s fun!
