R
Roberto
We installed win2003 advanced server with exchange 2003 enterprise. Then for
the purpose of authenticating the clients with the server and encrypting all
emails, we installed also the MICROSOFT certificate authority.
The first time any of our email user connects to the server, automatically
requests a new certificate (generated by our server) and so far everything
works fine. The server generates the certificate which the user installs in
his machine and from that moment he can sign his emails with that certificate
and later on he can start encrypting his emails.
The only thing is that because this certificate was generated by ourselves,
when the user sends a signed email the first time, the recipient (from an
external domain) has to do some kind of "TRUST THIS ISSUER" process, or
something like that on their client.
We are being audited specifically on this, and the tests we were running
with the auditor about encryption, went fine but at the end he told us that
he didn't like the "TRUST THIS ISSUER" thing and therefore he immediately
recommended to install a VERISIGN certificate on the server, so subsequent
certificates generated by the server will have some kind of additional trust
incorporated, so the "TRUST THIS ISSUER" process will not be necessary for
the recipients. These are his exact words:
"If you want to keep using your server as the certification authority, you
should get your server a VERISIGN certificate. This will automatically will
make the subsequent certificates generated by your server being "trusted" by
everyone."
In summary, what we need is:
Keep issuing the certificates ourselves (because that what executive
management wants) but that somehow has some kind of automatic trust
incorporated from our server.... so external clients won't have the "TRUST
THIS ISSUER" additional step when they receive and email from us.
We purchased today a Verisign Mail Server SSL Certificate and installed it
on the default web site on the IIS Manager. The problem with the "TRUST THIS
ISSUER" continues....
What needs to be done?
the purpose of authenticating the clients with the server and encrypting all
emails, we installed also the MICROSOFT certificate authority.
The first time any of our email user connects to the server, automatically
requests a new certificate (generated by our server) and so far everything
works fine. The server generates the certificate which the user installs in
his machine and from that moment he can sign his emails with that certificate
and later on he can start encrypting his emails.
The only thing is that because this certificate was generated by ourselves,
when the user sends a signed email the first time, the recipient (from an
external domain) has to do some kind of "TRUST THIS ISSUER" process, or
something like that on their client.
We are being audited specifically on this, and the tests we were running
with the auditor about encryption, went fine but at the end he told us that
he didn't like the "TRUST THIS ISSUER" thing and therefore he immediately
recommended to install a VERISIGN certificate on the server, so subsequent
certificates generated by the server will have some kind of additional trust
incorporated, so the "TRUST THIS ISSUER" process will not be necessary for
the recipients. These are his exact words:
"If you want to keep using your server as the certification authority, you
should get your server a VERISIGN certificate. This will automatically will
make the subsequent certificates generated by your server being "trusted" by
everyone."
In summary, what we need is:
Keep issuing the certificates ourselves (because that what executive
management wants) but that somehow has some kind of automatic trust
incorporated from our server.... so external clients won't have the "TRUST
THIS ISSUER" additional step when they receive and email from us.
We purchased today a Verisign Mail Server SSL Certificate and installed it
on the default web site on the IIS Manager. The problem with the "TRUST THIS
ISSUER" continues....
What needs to be done?
