SBS Certificate refuses to install in Trusted Root certificate Aut

Hi Folks I have a really annoying problem I hope someone can help me with...

I have an SBS 2003 R2 server with Xp pro clients - all fine.

I have 2 vista computers, the first moaned about the certificate so I had to
run IE7 as an administrator and install the SBS self signed certificate into
the trusted root Certificate authority store - no works fine, when I got to
OWA no annoying warnings etc.

On the second vista machine I try and install the certificate again in the
trusted root certificate authority - it says import successful but when I
look in that list it is not there. Also when I use OWA the warning still
appear and furthermore because of this I cannot use Outlook and RPC over http.

If you have any ideas why this machine won't install the certificate
properly I would be very grateful.......

Is there a cert for your SBS site already there?
If so Delete it.

Russ

--

Hi thanks for your suggestion - I noticed it had ended up in the intermediate
store so deleted it from there and tried again. Again it said import
successful but when I looked it wasn't in the list. It would let me import
into the intermediate store fine but not the trusted root certificate
authority.....

Hello Customer,

Thank you for posting here. Let's also thank Russ for the input.

According to your description, I understand that you unable to install SBS
certificate on Vista IE7 clients. If I have misunderstood the problem,
please don't hesitate to let me know.

Based on my research, I suggest we try the following steps to see if we can
resolve this issue:

1. Please install the following hotfix on SBS:

Windows Small Business Server 2003: Windows Vista and Outlook 2007
compatibility update
http://support.microsoft.com/?id=926505

2. Rerun the CEICW to configure the certificate again:

Go through the follow KB and rerun CEICW carefully.

How to configure Internet access in Windows Small Business Server 2003
http://support.microsoft.com/kb/825763/en-us

Detailed steps for your reference:

a. On the SBS 2003 Server open the Server Management console. Go to
Standard Management\To Do List.

b. Click the "Connect to the Internet" link.

c. On the "Web Server Certificate" page, choose to create a new Web server
certificate and then type the public domain name (your public DNS name)
that you will use to access OWA and RWW (for example, if your public domain
name that you use to access the sites is www.xyz.com, you should type
www.xyz.com as the new certificate name).

d. Go through the remaining steps.

3. Reset IE7 on Vista client:

a. Open IE7 Internet Options on Vista client,

b. Select Advanced tab, click Reset button

c. close and reopen IE7 to test this issue.

4. Please perform the steps in the following KB:

Warning message when a user tries to connect to a secure Web site by using
Internet Explorer 7: "There is a problem with this website's security
certificate"
http://support.microsoft.com/?id= 931850

a. In Windows Internet Explorer 7, click Continue to this website (not
recommended).
A red Address Bar and a certificate warning appear.
b. Click the Certificate Error button to open the information window.
c. Click View Certificates, and then click Install Certificate.
d. On the warning message that appears, click Yes to install the
certificate.

Notes:
a. In Windows Vista, the same issue occurs with self-signed certificates
when you use Internet Explorer 7. However, the option to install
certificates is not available unless you run Windows Internet Explorer 7
with administrator rights. To do this, right-click the Internet Explorer
icon, and then select Run as Administrator.

b. When the client computer connects to a Web server that is running
Windows Server 2003, the client computer reuses the certification authority
certificate. The client computer does not use another certificate that is
signed by the certification authority.

If we cannot resolve the issue after we perform the above steps, please
help me collect some information for further investigation:

Please capture screenshots on the error page and send the pictures to me at
v-terliu@microsoft.com

I hope these steps will give you some help.

Thanks and have a nice day!

Best regards,

Terence Liu(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities...s/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

Thanks to both of you for your help - much appreciated. Russ you were correct
- although I had cleared out the certificate from the intermediate store
where the OS placed it by default - upon re-checking every single certificate
store i found it in one of the others. Once i was happy it wasn't in any of
the stores I re-imported it into the Trusted Root certificate authority
store. During the process i ticked the "show physical stores tick box and
selected the "Local Computer" subfolder within the Trusted Root Certificate
Authorities folder.

Thanks guys!

When ever you have issues with SBS Certs
Just delete them on the PC and reinstall them...

And if no one can connect rerun the CEICW and create a new Cert
and go from there

Russ

--

[showme]

Hi All,

I have quite a similar problem with SBS 2008.

The server's cert is said to be OK and is for the correct domain. However, if I try to import it then nothing happens (does not show up in the trusted root CA section nor elsewhere) despite IE sais the import was successful.

I compared this cert to SBS 2003 certs and found that now, there is this Key Usage field which has an exclamation mark next to it.

The only way I could get the cert into IE was to export it together with a secret key to a PFX file and import this on the Clients. This way the key usage had more values and the import was really successful.

Unfortunately, this solution is not enugh for the users.

I would appreciate any ideas.

Thanks,
Peter

On 9/9/2010 4:07 AM, showme wrote:
> Hi All,
>
> I have quite a similar problem with SBS 2008.
>
> The server's cert is said to be OK and is for the correct domain.
> However, if I try to import it then nothing happens (does not show up in
> the trusted root CA section nor elsewhere) despite IE sais the import
> was successful.
>
> I compared this cert to SBS 2003 certs and found that now, there is this
> Key Usage field which has an exclamation mark next to it.
>
> The only way I could get the cert into IE was to export it together with
> a secret key to a PFX file and import this on the Clients. This way the
> key usage had more values and the import was really successful.
>
> Unfortunately, this solution is not enugh for the users.
>
> I would appreciate any ideas.
>
> Thanks,
> Peter
>
>
Buy a third party godaddy cert.

Apologies for this... but please repost to www.sbsforum.info this
newsgroup is closing tomorrow.