We're trying to use Microsoft Outlook's Connect to my Exchange mailbox using
HTTP feature to let a telecommuter connect directly and securely to our Microsoft
Exchange server—via HTTP Secure (HTTPS)—without having to first
establish a VPN connection. Our mobile users with laptops can connect directly
to the Exchange server, but the telecommuter can't—Outlook doesn't present
an error message, but it obviously doesn't accept the user's credentials because
it keeps prompting for them. The only difference between the telecommuter's
PC and our mobile users' laptops is that the telecommuter's PC isn't a member
of the domain. We don't want the user to revert from HTTPS to HTTP for obvious
security reasons. What's the solution?
The problem behind this frustrating behavior from Outlook is that the telecommuter's
PC doesn't trust your enterprise Certification Authority (CA). I'm assuming
that you used an enterprise CA to create the Web server certificate that Exchange
uses for Secure Sockets Layer (SSL) connections from remote clients. Because
your mobile users' laptops belong to your domain, they automatically trust all
enterprise CAs and accept the certificate. Your telecommuter's PC isn't a member
of the domain so it doesn't accept the certificate.
To fix the problem, just add your root enterprise CA's certificate to the Trusted Root Certification Authorities store on the telecommuter's PC. You can find the CA's certificate by opening a Web browser on your internal network and browsing to //CA1/certsrv, where CA1 is the name of the computer that hosts your CA. On the home page of the CA, click Download a CA certificate, certificate chain, or CRL, then click Download CA certificate. Save the certificate file to the telecommuter's PC.
On the telecommuter's PC, open the certificate file in Windows Explorer, which
displays the Certificate dialog box shown in Figure
1. Click Install Certificate, then click Next on each page of the Certificate
Import Wizard. When the certificate has been successfully imported, Outlook
will accept the telecommuter's credentials and let him or her access your Exchange
server over HTTPS.