RE: Re: [OT] Managing Group Mail with Exchange 2003

["Paul Gordon" <paul@xxxxxxxxxxxxxxxxxxxxx>]

.
>
>Yep! spot on - if you cant get your certs to match then rpc over http
is
a non starter. - The easy way to check is by getting a machine outside
your lan (on the wan even!) and to set your browser to
https://{externalip}/rpc$


I don't think you need the dollar sign on the URL, - you're thinking of
the
hidden NETBIOS share that is also called the same name.. the IIS virtual

directory that is created when you install the RPC/HTTP networking
components is just called RCP as I recall... (been a couple of months
since
I last set this up).

If you get the padlock on your browser without any prompts for certs etc

then it /should/ work. If you get prompted about certs in any way then
its a non starter (oh - make sure the pc you use you havnt already
manualy trusted the cert!). The reason being - outlook cant answer
questions about certificates etc so it doesn't know what to do.


Hmm... sort of... - it depends where you're certificate has come from,
and if it is already in the trusted root certificate store in your
client.. - If you re using a 3rd party CA, then this is probably true. -
However, if you are using a self-signed certificate, that it very
probably isn't true, - then it depends on your AD setup, and if the
client is a domain member... - You may very well expect to see a "This
certificate is from a CE that you have not chosen to trust" message..
-
in which case you should then import the certificate into the client..



Oh, when you get the page up you will defineatly see a 404 error from
the browser as there isn't anything that you can access in this
directory but its MS's 'check method' to see if its working.

You need to get your cert to have either your public ip address in it
(as the dn? distinguishing name??) or external dns address. If you don't

want to use IP addresses then probably the easiest way (unless you can
get to edit your public DNS space) is to get a dyndns account set up
(www.dyndns.org). That way you can add hosts at will or just use a
wildcard (*.mydomain.com) - but you still need a cert to match.

Have a look at http://support.microsoft.com/kb/833401/
<-- has a few
videos
or http://support.microsoft.com/default.aspx?scid=kb;en-us;827330


hth :)
Wayne.