The procedures in this document require the following:

• You have an operational Microsoft public key infrastructure (PKI) with root domain or Enterprise Domain administrator access to an issuing certification authority (CA). The example certificate deployments in this document refer to Windows Server 2003 without KB 922706 installed. The hotfix referenced in KB 922706 to support Web enrollment for Windows Vista and Windows Server 2008 removes the option to store an advanced certificate request in the computer store. This option is used in the certificate deployment examples in this document, so if this option is not available on your Web enrollment pages, you must use an alternative certificate deployment method for the examples in this document. For example, you can install the certificate into the user store and then export it and import it into the computer store, or you can use the command-line utility Certreq.exe to request the certificates.
  
• You have installed and configured ISA Server 2006 or ISA Server 2004 into an Active Directory domain. If you cannot join ISA Server to a domain environment (it is installed on a workgroup computer), you cannot use SSL bridging for Internet-based client management, and you can use server publishing (SSL tunneling) only. For instructions about how to configure ISA Server for server publishing of Configuration Manager Internet-based servers, see Appendix C in this document. For information about installing and other configuration solutions for ISA Server, see http://go.microsoft.com/fwlink/?LinkId=91897.
  
• You have installed System Center Configuration Manager and have configured a Configuration Manager Internet-based site. The instructions in this document are suitable for a single Configuration Manager Internet-based site system server that has installed one or more Internet-based site system roles, but does not include the Internet-based fallback status point. Additionally, these instructions require that certificate revocation checking is not enabled on Configuration Manager Internet-based clients. For more information about these requirements, see the following resources from the System Center Configuration Manager 2007 documentation library:
  
  • Determine If You Need to Enable Certificate Revocation Checking (CRL) on Clients (Native Mode) (http://go.microsoft.com/fwlink/?LinkId=120837).
    
  • Deploying Configuration Manager Sites to Support Internet-based Clients (http://go.microsoft.com/fwlink/?LinkId=120631).
    
• The Configuration Manager Internet-based site system server is configured to use a native mode certificate that contains the site system’s Internet FQDN in the certificate Subject name. When the site system accepts connections from intranet clients as well as from Internet clients, the certificate Subject name must contain the site system’s configured Internet FQDN, and the certificate Subject Alternative Name (SAN) must contain both the Internet FQDN and the intranet server name. When you are using a SAN, ensure that the Internet FQDN is specified as the Subject name and also as the first Subject Alternative Name (SAN) entry. For more information about the Configuration Manager certificate requirements, see the following resources from the System Center Configuration Manager 2007 documentation library:
  
  • Certificate Requirements for Native Mode (http://go.microsoft.com/fwlink/?LinkId=103553).
    
  • Deploying the PKI Certificates Required for Native Mode (http://go.microsoft.com/fwlink/?LinkId=103566).
    

Use the following community resources to help you implement an ISA Server solution with Configuration Manager Internet-based client management.

ISA Server:

• TechNet ISA Blog (http://blogs.technet.com/isablog)
  
• ISAServer.org (http://isaserver.org)
  

Configuration Manager Internet-based Client Management:

• TechNet forum: System Center Configuration Manager – Internet Clients and Native Mode (http://forums.microsoft.com/TechNet/ShowForum.aspx?ForumID=1888&SiteID=17)
  

Microsoft Certificate Services:

• TechNet forum: Security (http://forums.technet.microsoft.com/en-US/winserversecurity/threads/)
  

This ISA Server solution requires that Active Directory Domain Services contains computer accounts for each Configuration Manager Internet-based client computer. If any of your Internet-based client computers do not have a computer account that can be authenticated by the ISA Server computer (they are workgroup computers or computers from an untrusted domain), you must first create computer accounts for them in a domain that is trusted by the ISA Server. The computer name that you specify and the domain location will be referenced in the client authentication certificate.

After ensuring that all Internet-based computers have computer accounts in Active Directory Domain Services, create a security group to contain all these computer accounts. This security group will be used by ISA Server to control access to the Configuration Manager Internet-based services.

This solution requires that each Internet-based computer has a computer certificate with the following:

• Enhanced Key Usage (EKU) of Client Authentication (OID 1.3.6.1.5.5.7.3.2).
  
• Optional: Subject name (for example, the computer’s FQDN).
  
• Subject Alternative Name (SAN) extension using the following format: upn=<hostname>$@<domain.tld>. In this format, <hostname> is the unqualified name of the Configuration Manager Internet-based client computer and <domain.tld> is the Active Directory domain suffix where the Internet-based client computer account is located. For example, if the computer name is client1 and the computer account is in the contoso.com domain, specify upn=client1$@contoso.com for the SAN value.
  
• Private key.
  
• Key usage includes signing and encryption.
  

These certificates can be created and deployed with any CA that issues X.509-compliant certificates and that meets the preceding requirements.

Ensure that your CA supports the certificate SAN extension. By default, a CA that is configured on a Windows Server 2003-based computer does not issue certificates that contain the SAN extension. To enable SAN support on the CA, perform the following steps:

1. Log on to the server running Certificate Services by using an administrative account.
   
2. Click Start, click Run, type cmd, and then press Enter.
   
3. In the command window, type the following commands:
   
   1. certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
      
   2. net stop certsvc
      
   3. net start certsvc
      

The procedure in this section provides an example deployment of the Configuration Manager Internet-based client certificate with the required SAN. This example uses a Microsoft Windows Server 2003 stand-alone CA that is configured for manual approval, and it uses Web enrollment for a client computer that is running Windows XP. For an example deployment of the same certificate that is created and installed by using an enterprise CA with a custom certificate template, see Appendix A.

If these example deployment methods are not suitable for your environment, refer to your PKI documentation for alternative deployment methods. For example, if the Internet-based client computer does not have access to your CA, you can deploy the certificate to another computer that does have access to the CA, export the certificate, and then import it to the Internet-based client computer. This is the technique used in this document for the certificates to be installed on the ISA Server, and the procedure can easily be modified for the Internet-based client computer.

To Deploy an Internet-based Client Certificate with a UPN SAN by Using a Stand-alone CA:

1. Log on to an Internet-based computer by using an account that has local administrator access.

2. Load Internet Explorer and connect to the Web enrollment service with the address http://<server>/certsrv, where <server> is the name or IP address of the stand-alone CA.

3. On the Welcome page, select Request a certificate.

4. On the Request a Certificate page, click advanced certificate request.

5. On the Advanced Certificate Request page, select Create and submit a request to this CA.

6. On the Advanced Certificate page, specify the following:

   1. Type the FQDN of the requesting computer in the Name box, and then complete the remaining identification fields according to your company requirements.
      
   2. Select Client Authentication Certificate from the Type of Certificate Needed list.
      
   3. Select Store certificate in the local computer store in the Key Options section.
      
   4. Type SAN:upn=<hostname>$@<domain.tld> in the Attributes box where <hostname> is the unqualified name for the Internet-based computer and <domain.tld> is the domain suffix where the computer account is located in Active Directory Domain Services. For example, if the computer name is client1 and the computer belongs to the contoso.com domain, type san:upn=client1$@contoso.com in the Attributes text box.
      
   5. Type your choice of name in the Friendly Name box for easy identification of this client certificate.
      

7. Click Submit.

8. On the Certificate Pending page, you will see that your certificate request has been received but requires an administrator to issue the certificate. Make a note of the displayed Request ID, and do not exit Internet Explorer.

9. Log on to the CA, and load the Certification Authority console.

10. Click Pending Requests.

11. In the results pane, you will see the requested certificate with the Request ID that was displayed on the Web enrollment page.

12. Right-click the requested certificate, click All Tasks, and then click Issue.

13. On the Internet-based computer still running Internet Explorer and connected to the Web enrollment service, on the Microsoft Certificate Services Web page, click Home to return to the Welcome page.

14. On the Welcome page, click View the status of a pending certificate request.

15. On the View the Status of a Pending Certificate Request page, click the hyperlink that displays the certificate that you requested.

16. On the Certificate Issued Web page, click Install this certificate.

17. If you are prompted with a Potential Scripting Violation warning message, click Yes.

18. The final page should display a message saying that your new certificate has been successfully installed.

19. Close Internet Explorer.

The certificates that are needed on the ISA Server are the following:

• An ISA Server Web listener certificate.
  
• An ISA client authentication certificate.
  

The ISA Web listener certificate has the following requirements:

• Enhanced Key Usage (EKU) of Server Authentication (OID 1.3.6.1.5.5.7.3.1).
  
• Subject name contains the Internet FQDN of the Internet-based site system server.
  
• Private key that must be exportable.
  
• Key usage includes signing and encryption.
  

The ISA client authentication certificate has the following requirements:

• Enhanced Key Usage (EKU) of Client Authentication (OID 1.3.6.1.5.5.7.3.2).
  
• Subject name (for example, the ISA Server computer’s FQDN).
  
• Private key that must be exportable.
  
• Key usage includes signing and encryption.
  

These certificates can be created and deployed with any CA that issues X.509-compliant certificates and that meets the preceding requirements. The following procedures provide an example deployment that uses a Microsoft Windows Server 2003 stand-alone CA with Web enrollment; a domain computer running Windows XP is used to request the certificates.

In these example certificate deployments, the certificate request and issuance uses DCOM, which is unsupported across ISA Server networks. Therefore, another domain computer is used to request and install the certificates so that reconfiguration is not required for DCOM. The certificates are then exported and imported to ISA Server.

To Create the ISA Server Web Listener Certificate by Using a Stand-alone CA:

1. Log on to a domain computer by using an account that has local and domain administrator access.

2. Load Internet Explorer, and connect to the Web enrollment service with the address http://<server>/certsrv, where <server> is the name or IP address of the stand-alone CA.

3. On the Welcome page, select Request a certificate.

4. On the Request a Certificate page, click advanced certificate request.

5. On the Advanced Certificate Request page, select Create and submit a request to this CA.

6. On the Advanced Certificate page, specify the following:

   1. Type the Internet FQDN of the Internet-based site system server in the Name box, and then complete the remaining identification fields according to your company requirements.
      
   2. Select Server Authentication Certificate from the Type of Certificate Needed list.
      
   3. Select Mark keys as exportable and Store certificate in the local computer store in the Key Options section.
      
   4. Type your choice of name in the Friendly Name box for easy identification of this ISA Web listener certificate.
      

7. Click Submit.

8. On the Certificate Pending page, you will see that your certificate request has been received but requires an administrator to issue the certificate. Make a note of the displayed Request ID, and do not exit Internet Explorer.

9. Log on to the CA and load the Certification Authority console.

10. Click Pending Requests.

11. In the results pane, you will see the requested certificate with the Request ID that was displayed on the Web enrollment page.

12. Right-click the requested certificate, click All Tasks, and then click Issue.

13. On the Internet-based computer still running Internet Explorer and connected to the Web enrollment service, on the Microsoft Certificate Services Web page, click Home on the top right side to return to the Welcome page.

14. On the Welcome page, click View the status of a pending certificate request.

15. On the View the Status of a Pending Certificate Request page, click the link that displays the certificate that you requested.

16. On the Certificate Issued Web page, click Install this certificate.

17. If you are prompted with a Potential Scripting Violation warning message, click Yes.

18. The final page should display that your new certificate has been successfully installed.

19. Close Internet Explorer.

Repeat the preceding procedure, with the following variation for step 6:

To Create the ISA Client Authentication Certificate by Using a Stand-alone CA:

• On the Advanced Certificate page, specify the following:

  1. Type the FQDN of the ISA Server computer in the Name box, and then complete the remaining identification fields according to your company requirements.
     
  2. Select Client Authentication Certificate from the Type of Certificate Needed list.
     
  3. Select Mark keys as exportable and Store certificate in the local computer store in the Key Options section.
     
  4. Type your choice of name in the Friendly Name box for easy identification of this ISA client authentication certificate.
     

To Export the Certificates From the Requesting Computer:

1. On the computer that has the certificate installed, click Start, click Run, type MMC in the Run dialog box, and then click OK.

2. In the empty console, click File, and then click Add/Remove Snap-in.

3. In the Add or Remove Snap-ins dialog box, click Add.

4. Select Certificates from Available snap-ins, and then click Add.

5. In the Certificates snap-in dialog box, click Computer account, and then click Next.

6. In the Select Computer dialog box, ensure that the option Local computer: (the computer this console is running on) is selected, and then click Finish.

7. In the Add or Remove Snap-ins dialog box, click OK.

8. In the console, expand Certificates (Local Computer).

9. Expand Personal, and then click Certificates.

10. In the results pane, locate the certificate that you installed for the Web listener.

11. Right-click the certificate, click All Tasks, and then click Export.

12. In the Certificate Export Wizard, click Next.

13. On the Export Private Key page, select Yes, export the private key, and then click Next.

14. On the Password page, specify a strong password to protect the exported certificate with its private key, and then click Next.

15. On the Export File Format page, ensure that the following option is selected: Personal Information Exchange - PKCS #12 (.PFX).

16. Optionally, select Delete the private key if the export is successful, which will ensure that the certificate cannot be used on the requesting computer after you have exported it. This will help to ensure that the certificate is used only by the ISA server computer. Alternatively, you can manually delete the certificate on the computer after the export procedure is complete.

17. On the File to Export page, specify the name of a file to contain the exported certificate, and then click Next.

18. To close the wizard, click OK in the Certificate Export Wizard dialog box.

19. Repeat steps 10 through 18 for the client authentication certificate, ensuring that you specify a different file name.

20. Store the files securely, and ensure that you can access them securely from the ISA Server computer.

To Import the Certificates to the ISA Server:

1. On the computer running ISA Server, click Start, click Run, type MMC in the Run dialog box, and then click OK.

2. In the empty console, click File, and then click Add/Remove Snap-in.

3. In the Add or Remove Snap-ins dialog box, click Add.

4. Select Certificates from Available snap-ins, and then click Add.

5. In the Certificates snap-in dialog box, click Computer account, and then click Next.

6. In the Select Computer dialog box, ensure that the option Local computer: (the computer this console is running on) is selected, and then click Finish.

7. In the Add or Remove Snap-ins dialog box, click Add.

8. In the Certificates snap-in dialog box, click Service Account, and then click Next.

9. In the Select Computer dialog box, ensure that the option Local computer: (the computer this console is running on) is selected, and then click Next.

10. In the Certificates snap-in dialog box, select Microsoft Firewall as the Service account, and then click Finish.

11. Click Close, and then click OK.

12. In the console, expand Certificates (Local Computer).

13. Expand Certificates (Local Computer), right-click Personal, click All Tasks, and then click Import to run the Certificates Import Wizard.

14. Follow the wizard instructions to import the file that contains the exported ISA Web listener certificate.

15. In the console, expand Certificates - Service (Microsoft Firewall) on Local Computer, right-click fwsrv\Personal, click All Tasks, and then click Import to run the Certificates Import Wizard.

16. Follow the wizard instructions to import the file that contains the exported ISA client authentication certificate. Ensure that fwsrv\Personal is selected as the certificate store on the Certificate Store page.

The following procedure configures ISA Server 2006 for the Web publishing of a Configuration Manager Internet-based server. If you are running ISA Server 2004, the steps are slightly different because of the differences in the console navigation. The equivalent steps for ISA Server 2004 are listed in Appendix B.

The steps required to configure ISA Server for Web publishing are as follows:

• Create the Web listener.
  
• Modify the Web listener.
  
• Create the Web publishing rule.
  
• Modify the Web publishing rule certificate validation.
  
• Save the changes to ISA policies.
  

To Create the Web Listener:

1. On the ISA Server computer, load the ISA Server management console.

2. Select Firewall Policy by using the method that applies to your edition of ISA Server:

   • For Standard Edition: In the left pane, expand <Array Name>, and then select Firewall Policy.
     
   • For Enterprise Edition: In the left pane, expand Arrays, then expand <Array Name>, where <Array Name> is the array in which you want to create the publishing rule, and then select Firewall Policy.
     

3. In the task pane, click the Toolbox tab.

4. Click Network Objects, click New, and then click Web Listener.

5. On the Welcome to the New Web Listener Wizard page, type a name for the new Web listener, such as ConfigMgr Web Listener, and then click Next.

6. On the Client Connection Security page, ensure that Require SSL secured connections with clients is selected, and then click Next.

7. On the Web Listener IP Addresses page, select the networks where you want this Web listener to operate.

   Note:
   If your ISA Server is using a single network adapter template (unihomed), you must choose the Internal network.

8. If you want the Web listener to operate on a specific IP address within the selected network (recommended), perform the following actions:

   1. Select the required network, and then click Select IP Address.
      
   2. On the <Network Name> Listener IP Selection page, select Specified IP addresses on the ISA Server computer in the selected network.
      
   3. Select the required IP address, and then click Add. Repeat steps a through c for each network selected for this Web listener.
      

9. Click OK, and then click Next.

10. On the Listener SSL Certificates page, select Use a single certificate for this web listener, and then click Select Certificate.

11. On the Select Certificate dialog box, select the ISA Server Web listener certificate, click Select, and then click Next.

12. On the Authentication Settings page, select SSL Client Certificate Authentication from the Select how clients will provide credentials to ISA Server list.

13. Click Next, click Next, and then click Finish.

14. If you are prompted to enable the system policy that allows CRL downloads, click Yes.

To Modify the Web Listener:

1. In the ISA Server management console right pane, click the Toolbox tab.

2. Click Network Objects, and then expand Web Listeners.

3. Double-click the new Web Listener.

4. On the <Web Listener Name> Properties dialog box, click the Authentication tab, and then click Advanced.

5. On the Advanced Authentication Options dialog box, click the Client Certificate Trust List tab.

6. Click Only accept client certificates trusted by the Root Certification Authorities selected below, and then select the Certification Authorities that will issue certificates for the Configuration Manager Internet-based computers.

7. Click OK, and then click OK to close the Web listener properties.

To Create the Web Publishing rule:

1. In the ISA Server management console middle pane, click the rule that you want to be ordered immediately after the new Web publishing rule. Alternatively, you can reorder the new Web publishing rule after it is created.

2. In the left pane, right-click Firewall Policy, click New, and then click Web Site Publishing Rule.

3. On the Welcome to the New Web Publishing Rule Wizard page, type a name for the Web publishing rule, such as ConfigMgr Publishing, and then click Next.

4. On the Select Rule Action page, ensure that Allow is selected, and then click Next.

5. On the Publishing Type page, ensure that Publish a single Web site or load balancer is selected, and then click Next.

6. On the Server Connection Security page, ensure that Use SSL to connect to the published web server or server farm is selected, and then click Next.

7. On the Internal Publishing Details page, specify the following, and then click Next:

   1. Type the Internet FQDN in the Subject name of the certificate that is being used by the Internet-based site system server.
      
   2. Click Use a computer name or IP address to connect to the published server.
      
   3. Specify the Configuration Manager Internet-based site system server by typing in the IP address.
      

8. On the second Internal Publishing Details page, type /* in the Path (optional) box, and then click Next.

9. On the Public Name Details page, specify the following, and then click Next:

   1. Ensure that This domain name (type below) is selected.
      
   2. Type the Internet FQDN of the Internet-based site system server in the Public name box.
      
   3. Ensure that /* is displayed in the Path (optional) box.
      

10. On the Select Web Listener page, select the Web listener created for Internet-based clients, and then click Next.

11. On the Authentication Delegation page, ensure that No delegation, but client may authenticate directly is selected, and then click Next.

12. On the Users Sets page, click Add.

13. On the Add Users dialog box, click New to run the New User Set wizard.

14. On the Welcome to the New User Set Wizard page, type a name, such as Internet-based computers, and then click Next.

15. On the Users page, click Add, and then click Windows users and groups.

16. On the Select Users or Groups dialog box, specify the security group that you created previously to contain the computer accounts of the Internet-based computers, and click OK.

17. Click Next, and then click Finish.

18. On the Add Users dialog box, select the new user group, click Add, and then click Close.

19. On the Completing the New Web Publishing Rule Wizard page, click Finish.

To Modify the Web Publishing rule Certificate Validation:

1. In the ISA Server management console middle pane, double-click the new Web Publishing rule.

2. On the <Web Publishing Rule Name> Properties dialog box, click the Bridging tab.

3. Click Use a certificate to authenticate to the SSL Web server, and then click Select.

4. On the Select Certificate dialog box, select the ISA client certificate that you imported into the Microsoft Firewall personal certificate store, and then click Select.

5. On <Web Publishing Rule Name> Properties dialog box, click OK.

To Save the Web Publishing Changes to ISA Policies:

1. Click Apply when it displays in the middle pane of the ISA Server management console.

2. Wait for the policy update process to complete, and then click OK in the Saving Configuration Changes dialog box.

These appendixes contain additional information relating to configuring ISA Server for Configuration Manager Internet-based client management:

• Appendix A: Deploying an Internet-based Client Certificate with a UPN SAN by Using an Enterprise CA.
  
• Appendix B: Configuring ISA Server 2004 for Web Publishing of a Configuration Manager Internet-based Server.
  
• Appendix C: Configuring ISA Server for Server Publishing of a Configuration Manager Internet-based Server.
  

Appendix A: Deploying an Internet-based Client Certificate with a UPN SAN by Using an Enterprise CA

Appendix B: Configuring ISA Server 2004 for Web Publishing of a Configuration Manager Internet-based Server

Appendix C: Configuring ISA Server for Server publishing of a Configuration Manager Internet-based Server