Automatic install of SSL certificate   

Here's what we have:
Exchange 2003 running on Windows Small Business Server
OWA is configured and we have a cert we purchased through either
GoDaddy or Verisign.

The problem is that when my users go to access OWA they always get a
Security Alert stating the following:
Information you exchange with this site cannot be viewed or changed by
other. However, there is a problem with the security certificate.
! - The security certificate was issued by a compant you have not
chosen to trust, View the certificate to determin whether you want to
trust the certifying authority.
(check) - The security certificate date is valid
(check) - The security certificate has a valid name matching the name
of the page you are trying to view.
Do you want to Proceed?
Yes,No, View certificate


If my users click "Yes" then the get into OWA without a problem. This
would be fine if this Security Alert didn't show up every time they
accessed OWA.
If they "View Certificate" and install it, then they stop gettting the
Security Alert.

The problem is that I don't want to walk each user through installing
the certificate, I just want them to either NOT see the Security Alert
EVER, or I want them to click "yes" once and forget about it. Can this
be done?
Thanks for your help on this one...
A

date: 9 Feb 2006 13:44:27 -0800   author:   unknown

Re: Automatic install of SSL certificate   

>! - The security certificate was issued by a compant you have not
>chosen to trust, View the certificate to determin whether you want to
>trust the certifying authority.

In that case, that means that the CA is not trusted -- maybe you used
an entry-level service from the provider which doesn't give you a cert
chain that is pre-trusted by IE out-of-the-box?  

Such services do exist, which is offensive to me given that you can
get the same thing by installing your own CA!  Sometimes, such certs
are free, though, so I can't gripe with that.

>The problem is that I don't want to walk each user through installing
>the certificate, I just want them to either NOT see the Security Alert
>EVER, or I want them to click "yes" once and forget about it. Can this
>be done?

You won't be able to circumvent the process -- by design -- without
either installing the CA's cert in the client's local certificate
repository, or changing the nature of the cert chain (by getting a
cert from a more well-known CA).

--Sandy

date: Fri, 10 Feb 2006 00:38:23 -0500   author:   Sanford Whiteman