Enabling a Computer in Another Domain to Use an Enterprise CA Certificate

We're trying to use Microsoft Outlook's Connect to my Exchange mailbox using HTTP feature to let a telecommuter connect directly and securely to our Microsoft Exchange server—via HTTP Secure (HTTPS)—without having to first establish a VPN connection. Our mobile users with laptops can connect directly to the Exchange server, but the telecommuter can't—Outlook doesn't present an error message, but it obviously doesn't accept the user's credentials because it keeps prompting for them. The only difference between the telecommuter's PC and our mobile users' laptops is that the telecommuter's PC isn't a member of the domain. We don't want the user to revert from HTTPS to HTTP for obvious security reasons. What's the solution?

The problem behind this frustrating behavior from Outlook is that the telecommuter's PC doesn't trust your enterprise Certification Authority (CA). I'm assuming that you used an enterprise CA to create the Web server certificate that Exchange uses for Secure Sockets Layer (SSL) connections from remote clients. Because your mobile users' laptops belong to your domain, they automatically trust all enterprise CAs and accept the certificate. Your telecommuter's PC isn't a member of the domain so it doesn't accept the certificate.

To fix the problem, just add your root enterprise CA's certificate to the Trusted Root Certification Authorities store on the telecommuter's PC. You can find the CA's certificate by opening a Web browser on your internal network and browsing to //CA1/certsrv, where CA1 is the name of the computer that hosts your CA. On the home page of the CA, click Download a CA certificate, certificate chain, or CRL, then click Download CA certificate. Save the certificate file to the telecommuter's PC.

On the telecommuter's PC, open the certificate file in Windows Explorer, which displays the Certificate dialog box shown in Figure 1. Click Install Certificate, then click Next on each page of the Certificate Import Wizard. When the certificate has been successfully imported, Outlook will accept the telecommuter's credentials and let him or her access your Exchange server over HTTPS.