Client Outlook 2013 doesn’t connect from outside the company to the Exchange 2013

exchangeexchange-2013ssl-certificate

I have exchange 2013 server within the company operates correctly:

Owa it's OK
Outlook it's Ok
Send and receive emails without problems.
Has generated self-signed certificates.

When trying to access from outside the company:

The OWA service works properly.
Outlook simply does not connect and gives the error "The server must be online or connected …"
I had the same problem when accessing internally but resolved with the implementation of self-signed certificates and their deployment in the network.

The configuration on the utm is:

Services:
STMP: 25
POP3: 110 and 995
IMAP: 143 and 993
Active Sync 80 and 443

What can be the problem?
Thanks in Advance.

Best Answer

Don't use a self-signed certificate with Exchange. It's cheap enough to get a valid cert that will allow Outlook Anywhere to work properly. In addition you don't have to mess with mobile phones or tablets that would need the self-signed certificate trusted and installed.

Related Solutions

Can Exchange 2010 be configured to use different certificates for OWA and Outlooks

The usual answers to this problem are:

If your internal and external domains match, get a wildcard certificate
If they don't match, drop the extra $$ for the "Exchange SSL" certificates on offer at many SSL vendors

The special certificates have multiple Subject Alternate Names on them so they can be valid for a variety of names. Presumably, both your internal and external names for your OWA and RPC services.

Using self signed SSL for mail

I hate to differ, mailq, but SSL between MTAs (that is, between your mail server and other mail servers) is perfectly well-supported and well-understood. It runs happily on port 25. When you connect to a mail server offering this, it's advertised in the EHLO phase:

[madhatta@anni ~]$ telnet www.teaparty.net 25
Trying 193.219.118.100...
Connected to www.teaparty.net.
Escape character is '^]'.
220 : ESMTP you accept terms at http://www.teaparty.net/smtp.html
EHLO me
250-www.teaparty.net Hello 88-111-161-32.dynamic.dsl.as9105.com [88.111.161.32], pleased to meet you
[...]
250-STARTTLS
[...]

A fellow mail server who's willing to talk TLS can then request escalation to encrypted communication, and the rest of the SMTP conversation can then happen under cover of crypto. The signed or unsigned state of a peer's certificate shows up in my sendmail logs thus:

Sep 25 22:42:05 www sendmail[24905]: STARTTLS=server, relay=nagios.teaparty.net [82.26.102.225], version=TLSv1/SSLv3, verify=NO, cipher=DHE-RSA-AES256-SHA, bits=256/256

In this case, I'm connecting to the foreign server (or it would say STARTTLS=client) and I can't, using my certificate bundle, verify the peer's certificate (or it would say verify=YES). But it's perfectly sound crypto, and worth doing.

Other than that I agree with your (otherwise excellent) answer.

Best Answer

Related Solutions

Can Exchange 2010 be configured to use different certificates for OWA and Outlooks

Using self signed SSL for mail

Related Topic