Exchange-HSTS

Question

Exchange-HSTS

Salah Mohamed Ahmed Mohamed Owais 20

All Virtual directory like Owa, ECP (https://ip/owa) redirected to https, but original didn't exist (https://ip)

how i can enable it in original

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Anonymous

Hi @Salah Mohamed Ahmed Mohamed Owais ,

Welcome to the Microsoft Q&A platform!

It sounds like you're dealing with an Exchange Server setup, and you want to ensure that the default HTTP URLs for OWA (Outlook Web App) and ECP (Exchange Control Panel) are properly redirected to HTTPS.To ensure that your Exchange virtual directories like OWA and ECP are properly accessed via HTTPS and redirect HTTP requests to HTTPS, you can follow these steps:

Check SSL Certificates:

Make sure you have a valid SSL certificate installed and bound to the appropriate IIS site.

Configure HTTP to HTTPS Redirection in IIS:

- Open Internet Information Services (IIS) Manager.

- Expand the server node and then expand the "Sites" node.

- Select the "Default Web Site" (or the site hosting your Exchange virtual directories).

- In the Features View, double-click on "HTTP Redirect".

- Check the box "Redirect requests to this destination" and enter the URL with HTTPS (e.g., https://yourdomain/).

- Ensure "Only redirect requests to content in this directory (not subdirectories)" is unchecked.

- Check the box "Redirect all requests to exact destination (instead of relative to destination)".

- Select the redirection status code as 302 - Found.

- Click "Apply" in the Actions pane.

Ensure Virtual Directory Configuration:

- In the IIS Manager, navigate to the "Default Web Site" and then to "owa" and "ecp" virtual directories.

- Make sure that SSL is required for these directories:

- Right-click on the virtual directory (e.g., "owa") and choose "Edit Bindings".

- Make sure there is an HTTPS binding with a valid SSL certificate.

- Go to the SSL Settings of the virtual directory, and ensure "Require SSL" is checked.

Update Exchange Settings:

Run the following Exchange Management Shell commands to ensure that your OWA and ECP virtual directories are configured to require SSL:

Set-OwaVirtualDirectory -Identity "YourServerName\owa (Default Web Site)" -RequireSSL $true
Set-EcpVirtualDirectory -Identity "YourServerName\ecp (Default Web Site)" -RequireSSL $true

Restart IIS:

After making these changes, it's a good idea to restart IIS to ensure all settings take effect.

 iisreset /noforce

By following these steps, your Exchange server’s OWA and ECP should properly redirect HTTP requests to HTTPS, ensuring secure access.

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang

Salah Mohamed Ahmed Mohamed Owais 20 Reputation points

2024-08-29T08:08:23.2133333+00:00

hi Jake Zhang-MSFT

Thanks , i did do all steps as your mention, but when running developer tool , network, i found the original website https://exchnger server ip / without STS

how i can fix it .
Anonymous

2024-08-29T08:45:11.3366667+00:00
Hi @Salah Mohamed Ahmed Mohamed Owais ,

Thanks for your response!

It looks like you need to configure HTTP Strict Transport Security (HSTS) on your Exchange server to ensure that all connections are made using HTTPS. Here’s how you can do it:

Configuring HSTS on Exchange Server

1.On your Exchange server, open Internet Information Services (IIS) Manager.

2.In the Connections pane, expand the server node and select the site you want to configure (e.g., Default Web Site).

3.Add HTTP Response Headers:

In the Features View, double-click HTTP Response Headers.

In the Actions pane, click Add.

In the Add Custom HTTP Response Header dialog box, enter the following:

· Name: Strict-Transport-Security

· Value: max-age=31536000; includeSubDomains; preload

Click OK.

4.To apply the changes, you need to restart IIS. In the Actions pane, click Restart under Manage Server.

Using PowerShell

Alternatively, you can use PowerShell to configure HSTS:

1.Open PowerShell as an administrator.

2.Run the Following Command:

Import-Module WebAdministration Set-WebConfigurationProperty -Filter "system.webServer/httpProtocol/customHeaders" -Name "." -Value @{name='Strict-Transport-Security';value='max-age=31536000; includeSubDomains; preload'} -PSPath "IIS:\Sites\Default Web Site"

This will add the HSTS header to your site, ensuring that all HTTP requests are redirected to HTTPS.

By enabling HSTS, you can enhance the security of your Exchange server and ensure that all communications are encrypted.

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang
Salah Mohamed Ahmed Mohamed Owais 20 Reputation points

2024-08-29T11:01:11.72+00:00

Hi Jake Zhang

thanks for updating, i did attach screenshot , still the main page open without STS ,

all virtual dir working fine , but main page not .
Anonymous

2024-08-30T07:31:41.4233333+00:00
Hi @Salah Mohamed Ahmed Mohamed Owais ,

Thanks for your response!

It sounds like you’re having trouble with your main page not loading properly, even though all virtual directories are working fine. Here are a few steps you can try to troubleshoot the issue:

Look for any discrepancies or errors in the web.config file of your main application. Incorrect settings here can cause the main page to fail while virtual directories work fine.

Verify that the Internet Information Services (IIS) settings for the main site are correct. Ensure that the application pool is running and that there are no misconfigurations.

Look at the Windows Event Viewer for any error messages related to your application. This can provide clues about what might be going wrong.

Sometimes, cached data can cause issues. Clear your browser cache and try accessing the main page again.

Ensure that the necessary permissions are set correctly for the main page. Sometimes, permission issues can prevent the main page from loading.

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang
Anonymous

2024-09-02T01:46:39.02+00:00

Hi @Salah Mohamed Ahmed Mohamed Owais ,

Please kindly consider this comment as a warm follow up, I want to know if your problem has been solved. If you still have any other questions, please feel free to comment here and I'm glad to provide further support.If the above info is helpful to this question, you can click "Accept Answer". Have a nice day!

Best,

Jake Zhang

Share via

Exchange-HSTS

0 additional answers

Your answer