Implementing and Troubleshooting Certificate Deployment in ISA Server 2006

[LEFT][CODE]http://www.isaserver.org/tutorials/Implementing-Troubleshooting-Certificate-Deployment-ISA-Server-2006.html[/CODE]
[B][SIZE=3]
PART-1[/SIZE][/B]

n this article, we will cover certificate and certificate authority basics and how to use certificates in reverse proxy scenarios and how to troubleshoot certificate use and revocation.

[B]Let’s begin[/B]

Let’s start with some basics about PKI definitions, digital certificates and certificate authorities.
[B]PKI[/B]
In cryptography terms, a public key infrastructure (PKI) is the building block for several other technology aspects with the goal of issuing certificates for users, computers and services from a certificate authority (CA). The PKI role that issues certificates is called the Registration Authority (RA).
[B]Certificates[/B]
In cryptography, a public key certificate (or identity certificate) is an electronic document which incorporates a digital signature to bind together a public key with identity information such as the name of a person or an organization, their address, and so forth. The certificate can be used to verify that a public key belongs to an individual. In a typical public key infrastructure (PKI) scheme, the signature will be of a certificate authority (CA). Source: [URL="http://en.wikipedia.org/wiki/Digital_certificate"]Public key certificate - Wikipedia, the free encyclopedia[/URL]
[B]Certificate Authority[/B]
In cryptography terms, a certification authority (CA) is a server or a set of servers in a CA hierarchy which issues digital certificates for use by users, computers and services. Windows Server 2003 (and older versions) has its own CA implementation.
Certification authorities can be a single server or can be chained into certificate chains where every hierarchy has special tasks like intermediate CA, issuing CA and more. You will see a CA hierarchy in the following picture.
[B][IMG]http://www.isaserver.org/img/upl/image0011215423114750.jpg[/IMG]
[/B][B]Figure 1:[/B] CA Hierarchy
[B]File extensions used in Cryptography[/B]

There are several file extension which are used when you work with ISA Server 2006 and certificates. Here are some examples:

[LEFT][B]Key[/B][/LEFT]
[CENTER][B]Description[/B][/CENTER]
PCKS #12
Private Information Exchange
.PFX
Private Information Exchange
.P12
Private Information Exchange
PCKS #7
Cryptographic Message Syntax Standard
.P7B
PCKS #7 certificate
.CER
DER-coded-binary X.509
Base-64-coded-X.509
.PFX
Private Information Exchange PCKS #12
.CRL
Certification Revocation List
.P7C
Digital ID-file
.P7M
PCKS #7 MIME-message
.P7R
PCKS #7 certificate
.P7S
PCKS #7 signature
[B]Table 1:[/B] PKI file extensions [B]Installing a CA[/B]

Installing and operating a CA is a relatively easy process. What makes PKI designs complicated are the several applications which use this PKI for several purposes.
This article is not designed to show you the whole installation process; I will only cover some pictures.
[B][IMG]http://www.isaserver.org/img/upl/image0031215423114750.jpg[/IMG]
[/B][B]Figure 2:[/B] Installing a Windows CA
After installing the CA, the Server name and the domain membership should not be changed (If you feel pain: There is a KB article which gives you a chance to move the CA).
There are several types of CA. For this example we select a Enterprise Root CA which integrates into Active Directory.
[B][IMG]http://www.isaserver.org/img/upl/image0051215423114765.jpg[/IMG]
[/B][B]Figure 3:[/B] Select CA type
Give the CA a name and a lifetime.
[IMG]http://www.isaserver.org/img/upl/image0071215423137422.jpg[/IMG]
[B]Figure 4:[/B] CA Name
After installing the CA, the CA can be used for issuing certificates
[B]Certificate Snap-In [/B]

Every modern Windows version has a certificate Snap-In which handles locally installed certificates. If you are logged in as an Administrator, you can manage certificates for your own user account, a service account and a computer account.
[B][IMG]http://www.isaserver.org/img/upl/image0091215423137422.jpg[/IMG]
[/B][B]Figure 5:[/B] Manage certificates
A normal user account can only open its own certificate store.
Certificates can be managed in the console (Import, export, request new certificates and certificate deletion).
[B][IMG]http://www.isaserver.org/img/upl/image0111215423137422.jpg[/IMG]
[/B][B]Figure 6:[/B] Manage certificates
There is also a website which can be used to request new certificates or to download CA root certificates.
[B][IMG]http://www.isaserver.org/img/upl/image0131215423160469.jpg[/IMG]
[/B][B]Figure 7:[/B] CA website
[B]Settings in a reverse publishing scenario[/B]

If you want to use ISA Server as a reverse publishing proxy to publish services like Outlook Web Access (OWA) or Outlook Anywhere (OA), it is possible to enable SSL Bridging to enhance the security of ISA Server. When SSL Bridging is enabled, ISA Server terminates the SSL connection from the Server to the client; ISA then inspects the traffic and encrypts the traffic to HTTPS again. This is the most secure scenario.
In this scenario, ISA server needs the Root CA certificate from the internal CA that has issued certificates for the server to publish. ISA Server also needs a certificate for the ISA listener which Common Name (CN) has the same entry as the public name which clients enter when they try to establish a connection with the published server.
During the publishing process, ISA Server 2006 has a new certificate assistant that helps you to select the correct certificate. For troubleshooting purposes read the SSL troubleshooting article that is linked at the end of this article.
The certificate must be issued from a trusted CA, the certificate must be valid and keep a closer look at the Common Name of the certificate. The CN must match the public name that clients use to connect to the server.
[B][IMG]http://www.isaserver.org/img/upl/image0151215423160469.jpg[/IMG]
[/B][B]Figure 8:[/B] Certificate assistant
[B]What is the Bridging Tab in ISA Server 2006?[/B]

Have you ever tried to use the Bridging feature in the publishing rule? If you try to select the certificate, ISA often says that there is no certificate, right?
To get this working you must issue a user certificate for a normal user. This issued certificate must be imported (with the private key) into the local certificate store of the Microsoft ISA Server Firewall service. After that you can use the certificate to redirect incoming request to the internal server which requires certificate authentication.
[B][IMG]http://www.isaserver.org/img/upl/image0171215423160484.jpg[/IMG]
[/B][B]Figure 9:[/B] SSL Bridging
There are no certificates that are available because there is no certificate installed in the local certificate store of the ISA Server Firewall service.
[B][IMG]http://www.isaserver.org/img/upl/image0191215423179640.jpg[/IMG]
[/B][B]Figure 10:[/B] SSL Bridging – select a certificate
[B]Certificate revocation[/B]

Certificate revocation is the process when an application requests the certificate chaining engine to evaluate a certificate, the validation is performed on all certificates in that certificates chain. This includes every certificate from the issuing CA to the issued certificate. As a first step the certificate chain will be evaluated. If the certificate chain is intact, the process checks that:

[LIST][*]The certificates signature is valid[*]Verify that the current date and time from the certificate falls into the valid time period of the certificate.[*]Verify that each certificate is not corrupt or malformed[/LIST]
A certificate revocation list contains no more valid certificates. A process or Software like ISA Server can check the requested certificate against the certificate revocation list.
It is possible to configure ISA Server for several validation requests. ISA Server can verify that incoming certificates are not in the Certificate Revocation List (CRL).
[B][IMG]http://www.isaserver.org/img/upl/image0211215423179640.jpg[/IMG]
[/B][B]Figure 11:[/B] Certificate revocation
[B]Verify that incoming client certificates are not revoked [/B]
You must select this certificate if you want to let ISA Server to perform a check of the incoming certificate against the Certificate revocation List (CRL) to see if the certificate is revoked. If the certificate is revoked, the client request will be denied.
[B]Verify that incoming server certificates are not revoked in a forward scenario [/B]
This option is a little different from the scenario above. In this scenario, ISA server checks to see if the incoming Server certificate in an SSL Bridging scenario is revoked. If the certificate is revoked, the request will be denied.
[B]Verify that incoming server certificates are not revoked in a reverse scenario [/B]
Select this check box to specify that ISA Server will automatically check the Certificate Revocation List (CRL) to see if server certificates, in a Web publishing scenario, are revoked. If the certificate is revoked, the request will be denied.
[B]Conclusion[/B]

In this article I tried to show you all aspects of certificate use in ISA Server 2006 for reverse publishing scenarios for Outlook Web Access (OWA), Outlook Anywhere (OA) and more. I also tried to give you some basics about certificates, certificate authorities and certificate checks.




[/LEFT]

[LEFT][CODE]http://www.isaserver.org/tutorials/Microsoft-ISA-Server-2006-Certificate-troubleshooting-Part2.html[/CODE]
[B][SIZE=3]
PART-2[/SIZE][/B]


How ISA Server 2006 uses digital certificates in web chaining and reverse publishing scenarios.

[B]Introduction[/B]

In this article, I will give you some additional information about how ISA Server 2006 uses digital certificates in web chaining and reverse publishing scenarios. This is the second article of my series on ISA Server 2006 certificate deployment, published in July 2008 on [URL="http://www.isaserver.org/"]www.ISAserver.org[/URL]
[B]Let us get to it…[/B]

Let us start with a short explanation of the type of certificates used in secure publishing scenarios and move on to explain what functionality SAN certificates (SAN = Subject Alternate Name) provides and what distinguishes them from classic certificates, like wildcard certificates.
[B]Certificate Types[/B]

There are three types of certificates which are often used:

[LIST][*]Normal certificates[*]Wildcard certificates[*]Subject Alternate Name certificates (SAN)[/LIST]
[B]Normal certificates[/B]
A normal certificate is the “classic” certificate. This type of certificate is issued for only one FQDN = Fully Qualified Domain Name aka a DNS hostname like owa.it-training-grote.de.
[B]Wildcard certificates[/B]
A Wildcard certificate is often used when a company needs to publish different hostnames with the same domain name. Instead of using multiple normal certificates, it is possible to use this type of certificate. As an example if you buy a wildcard certificate for *.it-training-grote.de, it is possible to use the certificate to publish webservers with, for example, the names owa.it-training-grote.de and [url]www.it-training-grote.de[/url].
[B]SAN certificates[/B]
SAN (Subject Alternate Name) certificates are also often called multi domain certificates or Unified Communication (UC) certificates. With the help of SAN certificates it is possible to publish multiple FQDN with the same or other Top Level Domain (TLD) name.
For example:
[I]owa.it-training-grote.de[/I]
[I][url]www.it-training-grote.de[/url][/I]
[I]Server01[/I]
[I]Server01.exchange.internal[/I]
[I]Autodiscover.exchange.internal[/I]
[I]Autodiscover.it-training-grote.de[/I]
A SAN certificate is widly used in Exchange Server publishing scenarios with or without ISA Server 2006.
[B]ISA Server 2006 Service Pack 1 certificate enhancements[/B]

ISA Server 2006 Service Pack 1 supports the use of SAN certificates. Prior to ISA Server 2006 Service Pack 1, ISA Server only checked the first name in the certificate and ignored the additional names in the SAN field of the certificate.
[B]Using self signed certificates[/B]

One way to use certificates for ISA Server publishing is to use the SELFSSL.EXE tool from the IIS 6 resource kit . With the help of the SELFSSL tool administrators can create certificates which every Common Name (CN) they want.
[IMG]http://www.isaserver.org/img/upl/image0021257181270102.jpg[/IMG]
[B]Figure 1:[/B] SELFSSL from the IIS 6 Resource Kit
Because a self signed certificate is not issued by a trusted Root Certificate Authority you must manually place the self signed certificate in the Trusted Root CA store on the local ISA Server.
[IMG]http://www.isaserver.org/img/upl/image0041257181270117.jpg[/IMG]
[B]Figure 2:[/B] Add certificate Snap-In
Next, select the local Computer account as the certificate store to see all local installed certificates, which ISA Server uses for publishing and webchaining scenarios.
[IMG]http://www.isaserver.org/img/upl/image0061257181270133.jpg[/IMG]
[B]Figure 3:[/B] Display certificates in certificate store
[B]Trusted Root CA certificates[/B]

ISA Server ensures that each certificate used can be verified against the issuing Certificate Authority. ISA Server checks the certificate chain of the certificate to the Root CA. The list of trusted Root Certificate Authorities can be found in the local computer certificate store on the ISA Server 2006 machine.
[IMG]http://www.isaserver.org/img/upl/image0081257181270133.jpg[/IMG]
[B]Figure 4:[/B] Trusted Root CA certificates
[B]Certificates used in Web chaining scenarios[/B]

One of the less used features in ISA Server 2006 is the use of certificates in ISA Server web chaining scenarios. Web chaining is used to chain the Web traffic from ISA Server with another Webproxy like ISA Server. To use a certificate in a webchaining scenario, the following prerequisites must be present:

[LIST][*]Have a client authentication certificate[*]Be trusted by the issuing Root Certificate Authority[*]Have a private key installed in the local computer certificate store[*]Be installed in the Firewall service account personal certificate store[/LIST]
[IMG]http://www.isaserver.org/img/upl/image0101257181342586.jpg[/IMG]
[B]Figure 5:[/B] Select certificates in web chaining scenarios
[B]Exchange Remote Connectivity Analyzer[/B]

The Microsoft Exchange Remote Connectivity Analyzer is a helpful tool to test different types of Exchange Server publishings with and without ISA Server, without the use of the required tools like Microsoft Outlook.The Exchange Remote Connectivity Analyzer is also very helpful to verifiy the correct Deployment of certificates on the Exchange Client Access Server (CAS) or/and on the ISA Server.
[IMG]http://www.isaserver.org/img/upl/image0121257181342602.jpg[/IMG]
[B]Figure 6:[/B] Exchange Remote Connectivity Analyzer checks
[B]ISA Server 2006 Best Practice Analyzer[/B]

On helpful troubleshooting utility for certificate issues with ISA Server 2006 is the well known ISA Server 2006 Best Practice Analyzer which analyzes the ISA Server installation against a database with best practices from Microsoft to find possible missconfigurations or other problems. For certificate troubleshooting purposes, ISABPA checks the ISA Server configuration and looks if certificates are used in publishing or web chaining scenarios, if the corresponding certificates can be found in the local computer certificate store.
[IMG]http://www.isaserver.org/img/upl/image0141257181342602.jpg[/IMG]
[B]Figure 7:[/B] ISA Server Best Practices Analyzer
To give you some information about how ISABPA displays certificate related issues, I deleted all certificates from the local computer store.
[B]Conclusion[/B]

In this article, I tried to give you some more information about ISA Server 2006 certificate deployment and troubleshooting. We also covered some new features of ISA Server 2006 Service Pack 1 which extends ISA Server 2006 capabilities to use SAN certificates in webserver publishing scenarios.


[/LEFT]