When You Can Use the Self-Signed Certificate
There are several protocols and situations where the self-signed certificate can be used to encrypt communications. Domain-joined Outlook clients can use the self-signed certificate to encrypt e-mail messages and to encrypt the communications channel between the client and the Exchange server. As previously mentioned, Outlook Web Access users can also use the self-signed certificate to encrypt communication channels. You can also use the self-signed certificate to encrypt communications between Client Access servers in different Active Directory directory service sites. This scenario, known as CAS-CAS proxying, requires a registry modification to work correctly.
Using the Self-Signed Certificate with Domain-Joined Outlook 2007 Clients
The self-signed certificate works without any additional configuration for domain-joined Microsoft Office Outlook 2007 clients. These clients can connect without receiving any security warnings because the URLs they use to connect to the Autodiscover service all reference the internal FQDN of the Client Access server. The self-signed certificate has a common name that maps to the NetBIOS name of the server. The self-signed certificate also includes the FQDN of the server as an additional DNS name that is stored in the certificate’s Subject Alternative Name field. This allows domain-joined clients to successfully connect to the Autodiscover service without receiving any certificate warnings because the certificate has not expired and the FQDN of the server you are connecting to is stored in the Subject Alternative Name of the certificate. Although the client is unable to validate the self-signed certificate up to the trusted root, this validation failure is allowed when domain-joined clients connect to the Autodiscover service using the self-signed certificate. However, we do not recommend long-term use of this self-signed certificate because it was primarily intended to ease the urgency of obtaining a correct certificate so that Outlook 2007 clients can immediately start to use Exchange 2007 features.
Using the Self-Signed Certificate with Proxying
There are several steps that must be taken before you can successfully use the self-signed certificate to encrypt communications between clients and servers in a proxying scenario. For more information about proxying, see Understanding Proxying and Redirection.
You must modify the registry in order to support the use of self-signed certificates with proxying. Your clients will receive a prompt when they connect to the Exchange 2007 Client Access server because the self-signed certificate is considered invalid by most client applications, such as Exchange ActiveSync and Microsoft Office Outlook 2007. Both Exchange ActiveSync and Outlook Web Access support proxying from one Client Access server to another. For proxying to be successful when a self-signed certificate is used, you must configure the following registry keys on the Internet-Facing Client Access server:
-
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeOWA\AllowInternalUntrustedCerts = 1
-
HKLM\System\CurrentControlSet\Services\MSExchangeOWA\AllowExternallUntrustedCerts = 1
These registry keys will allow the Internet-facing Client Access server to connect to a non-Internet facing Client Access server by using a self-signed certificate installed on the non-Internet facing Client Access server. If the Internet-facing Client Access server uses a self-signed certificate for client communications, all the previously mentioned limitations will apply.
Incorrectly editing the registry can cause serious problems that may require you to reinstall your operating system. Problems resulting from editing the registry incorrectly may not be able to be resolved. Before editing the registry, back up any valuable data.