"This Security Certificate Was Issued by a Company that You Have Not Chosen to Trust"

When implementing an SSL solution, say to provide secure access to your OWA server, should you decide put in place your own PKI or certification authority as opposed to just getting the cheque book out and purchasing a certificate from a third party, you'll need to remember that the certificates issued by your CA aren't trusted by your browser, even Internet Explorer, as they've not been issued by a trusted root certification authority. This means that security warnings will be issued whenever you try to access your 'secure' site and to use the issued certificate. For example, when accessing OWA on an environment running Windows 2003 certificate services, you will receive the following warning dialog when accessing the site.

While it's possible just to continually select 'Yes' and to proceed past this warning and to access the OWA served mailbox securely, it's probably not good practice to ask and encourage your users to select 'Yes' to a security warning. Heck, who knows what the next warning might be that they say 'aye' to... some Gator-like malware install perhaps? Instead, it's a much better idea to install your root certificate in your clients' browser certificate store. Doing this will stop the warning from being displayed. This is a simple enough task, although before you begin it's important to note that you are installing your CA's root certificate into the browser, and not the certificate that's been issued to the OWA server and then to your browser. Therefore, it's not possible merely to select the 'View Certificate' option published on the security warning, and to then choose 'Install certificate.' Instead, it is necessary to export the CA's root certificate (.crt) file to a Base64 root certificate (.cer) file and to import this certificate.

To do this...

Find and then double-click the root certificate file.
Click the Details tab and select Copy to file to start the Certificate Manager Export Wizard.
On the second screen of the wizard select Base64, and on the third screen provide a path and file name for the certificate.

Once you have exported the certificate it needs to be imported into the browser...

Double click the .cer file
Choose 'Install certificate' which will start the certificate import wizard.
On the 'Certificate Store page,' do not choose the default 'Automatically select the certificate store,' instead choose 'Place all certificates in the following store.' Hit 'Browse' and then select 'Trusted Root Certification Authorities.'

Then 'OK,' 'Next,' and 'Finish.'

A security warning will be displayed stating that you are installing a certificate that can't be validated.

Choose 'Yes' and you should receive an 'Import was successful' dialog. Now when you access your OWA site, the warning won't be displayed, and you should also notice a considerable improvement in the delivery of the logon page/mailbox.

If you have a large number of users you will want to look at using a Group Policy to rollout the certificate install, or at least to provide secure, but simple access to the file, along with simple to follow instructions for your users to carry out the task themselves.

So now that you have gotten rid of this warning, you're going to make sure that your boss knows that you've saved him a few hundred pounds (or dollars!) and that all is now well. (in reality it may have cost more in time to implement than a third party certificate would have cost to buy). However... if you're also making use of Outlook Mobile Access, not using a third party certificate may come back to bite. Depending on the mobile device being used (Windows powered Smartphones are fine) the browser being used will again throw-up a warning about the certificate not being trusted or verified, and in some cases that'll be the end of the line i.e. the browser won't offer the ability to import your own certificate, and there'll be no way past the error/warning. Therefore, if you want to make life easier for everyone - yourself, and your users, and to ensure that mailboxes will be easily accessible, using whatever method/device, a third party cerificate is probably the way to go.

There is a KB article on importing a root certificate however the Rootinstall.asp file throws-up errors if used with IE 6.