Coexistence Manager for GroupWise 1.7 - FBC Configuration Guide

Step 3: Configure the Exchange side

Other than an accommodation for multiple subdomains (see next subtopic below), no additional Exchange configuration is necessary for the FBC to work with an Exchange environment whose Outlook clients are all version 2007 or later, and where Exchange will connect with the FBC by Microsoft’s Autodiscover and EWS (without Exchange public folders). This Exchange-side scenario is illustrated here:

If you are configuring FBC for a hybrid Office 365: Remember that the FBC for a hybrid O365 is configured only between GroupWise and the local on-premises Exchange, while synchronization of the local Exchange to O365 is configured apart from CMG (and documented separately by Microsoft). Configuration of CMG’s FBC for a hybrid O365 is therefore the same as configuring for a local on-premises Exchange—as described here.

To configure the Exchange side for multiple subdomains

CMG’s Free/Busy Connector can facilitate the flow of free/busy information among multiple subdomains supported by both the Exchange and GroupWise servers. To support this scenario, run the Add-AvailabilityAddressSpace cmdlet on the Exchange server or Office 365 for each GroupWise SMTP domain supported.

Step 4: Configure CMG's FBC Web Server

Step 4: Configure CMG’s FBC Web Server

To configure CMG’s FBC Web Server:

• 4.1: Physically install the CMG FBC components
• 4.2: Obtain and install web services certificates
• 4.3: Configure trusted sites for computers hosting F/B components
• 4.4 (optional): Configure logging for F/B components
• 4.5: Run CMG’s Management Console to configure FBC components

4.1: Physically install the CMG FBC components

For any given scenario and configuration, it is possible to install all CMG F/B Connector components on a single server, as shown in the illustrations in the introductory chapter (Determine your FBC scenario) of this Guide. However, many production environments experience sufficient query volume to warrant separate servers to ensure optimal performance. The installation instructions here therefore describe how to install CMG’s F/B Connector on two servers.

If you prefer that all subcomponents reside on a single server, simply combine the components of CMG Server 1 and CMG Server 2 as they are listed in step 1 above. All CMG Free/BusyConnector subcomponents are installed by the AutoRun utility included in the CMG product kit.

See the configuration map you made in step 1 above to determine which components should be installed to which servers for this scenario.


	IMPORTANT: Before you install, on any computer that will host any CMG FBC web subcomponent, remove the IIS DefaultWebSite: In the navigation tree at left, right-click DefaultWebSite, and then select Remove from the pop-up menu. CMG requires a dedicated server for its own web subcomponents.

Use the AutoRun utility now to install all the necessary CMG F/B Connector subcomponents on the computer(s) where you want them installed.


	IMPORTANT: Remember, the CMG AutoRun installer must be run on the computer where you want to install a particular subcomponent. If you are deploying the F/B Connector to two different computers, you must run the AutoRun installer twice—once on each computer.


	NOTE: The AutoRun installer automatically checks your environment to verify CMG prerequisites, but you can bypass the prerequisites check by running the installer from the command line and appending ignoreprerequisites=1 to the command string.

To configure CMG’s F/B Connector for multiple GroupWise servers

Remember: For Exchange queries for GroupWise F/B information, the simplest approach is to dedicate a separate CMG FBC Server 2 (as noted in step 1 above, for Exchange queries to GroupWise, and GroupWise replies) for each GroupWise server, with all the CMG servers feeding into the single Exchange server.

It is technically possible, but somewhat more complicated, to configure a single instance of the GroupWise FBC Service, EWS and Autodiscover to process free/busy traffic to and from multiple GroupWise servers—an approach that requires more elaborate GroupWise configurations.

4.2: Obtain and install web services certificates

CMG Web Server components must support HTTPS to accept SSL connections. The server on which these components are installed must have a certificate that Exchange trusts. The single certificate must cover the primary domain and all subdomains supported by the GroupWise Server. The certificate covers the Autodiscover and EWS web services.

CMG includes an Autodiscover Certificate Wizard to automate much of the process of installing this necessary certificate for the Free/Busy Connector. The wizard can be launched from CMG’s Management Console, on the Quest Web Services screen (under GroupWise Free/Busy Connector), as described in the procedure documented in the next subtopic below (see Using the Autodiscover Certificate Wizard to Obtain and Install a Certificate). Alternatively you can manually request and install a certificate, as described in the second subtopic below (see To Manually Request and Install a Certificate Using IIS 7.0–8.5).

Using the Autodiscover Certificate Wizard to Obtain and Install a Certificate

Even when using the wizard, you will still have to manually request the certificate, and then tell the wizard where the certificate file resides, so the wizard can install it for use with CMG.

To use the Autodiscover Certificate Wizard to install the necessary web services certificate using IIS 7.0–8.5:

In CMG’s Management Console, on the Quest Web Services screen (under GroupWise Free/Busy Connector): Click the Autodiscover Certificate Wizard button to launch the wizard.

Enter the information requested by the wizard until the wizard displays a window of data for you to copy to a certificate request form. Copy (Ctrl+a) the data.

At this point the wizard will remain open, waiting for you to obtain the certificate. You can obtain a certificate from a local certification authority (CA) if you are using an on-premises Exchange server, or from a public CA (like Verisign or Microsoft Active Directory Certificate Services) if you are using Exchange in a hosted environment (e.g., Office 365).


	NOTE: If you need a multi-domain certificate: See To Create a SAN Certificate below.


	NOTE: You can request a certificate using Web enrollment pages. For more information, see http://support.microsoft.com/kb/931351.

Request and obtain the certificate (while the CMG wizard waits).

To get a certificate from a public CA: Go to the web site of the public CA, and follow their instructions to request a certificate. At some point you will paste into the request form the text you copied from the wizard (in step 2 above).

To request a certificate from a local CA:

From a web browser, enter https://<Local_Certification_Authority_computer>/certsrv

Click Request a certificate, then click Advanced certificate request.

Select Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64- encoded PKCS #7 file.

Paste the text you copied from the wizard (in step 2 above) into the certificate request form.

In the Certificate Template box, select Web Server.

Click Submit.

Select Base 64 Encoded, then select Download certificate.

Back in the Autodiscover Certificate Wizard: Click Next.

Specify the path and filename of the certificate file downloaded in step 3 above, and click Finish to register the file and dismiss the wizard.

To Manually Request and Install a Certificate Using IIS 7.0–8.5

To manually request a certificate using IIS 7.0–8.5:

From Internet Information Services, click Server Certificates.

From the Actions Pane, select Create Certificate Request.

Enter autodiscover.<smtpdomain> or <smtpdomain> for the primary domain and all required subdomains. Then click Next.

Accept the defaults, and click Next.

Specify the file name, and click Finish.

Request a certificate using a local CA or public CA.

To get a certificate from a public CA: Go to the web site of the public CA, and follow their instructions to request a certificate.

To request a certificate from a local CA:

From a web browser, enter https://<Local_Certification_Authority_computer>/certsrv

Click Request a certificate, then click Advanced certificate request.

Select Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64- encoded PKCS #7 file.

Open the text file where you save the certificate request.

Copy and paste the text from the certificate request into the Saved Request box when you selected Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

In the Certificate Template box, select Web Server.

Click Submit.

Select Base 64 Encoded, then select Download certificate.

To manually install the certificate using IIS 7.0–8.5:

From Internet Information Services, click Server Certificates.

From the Actions Pane, select Complete Certificate Request.

Select the saved certificate file, and enter a friendly name for the certificate, then click OK.

NOTE: To create an https binding for the web site using IIS 7.0–8.5:

From the Connection Pane in IIS, select QuestFreeBusy.

From the Actions Pane, select Bindings.

Select Add. Select https as the type for a secure site, and enter the IP address and port number.

Select the SSL certificate to pass the certificate into the computer account, and click View to view any certificate information.

To Create a SAN Certificate

This procedure lets you configure a single certificate to answer for multiple addresses. This is obviously necessary for a multi-/subdomain configuration, but also, for a single-namespace environment, to create a certificate that will cover both Autodiscover and the root domain.

First, you must enable the SAN (Subject Alternate Name) flag on your CA. On the machine running CA services, run these commands at the command prompt to enable the flag:

certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
net stop certsvc
net start certsvc

When the SAN flag is enabled, you can create the certificate:

Open IIS on the machine running F/B and select the server. Scroll to the bottom, open Server Certificates, and click on Create Certificate Request.

For the common name, enter something appropriate for your larger domain. For example, for a domain alejandro.xyzcorp.com, the common name on the certificate is *.xyzcorp.com. (This is somewhat generic, as we will later add specific namespaces to the certificate.)

Accept the defaults and enter a name for the request.

Open the certificate request you just created, and select and copy all of the text.

Open the certificate web enrollment page for the CA of your domain— e.g., https://hostname/certsrv. Then select Request a Certificate, and then select Advanced Certificate Request.

Select Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

In the Base-64-encoded certificate request box, paste all of the text that you copied from the text file in step 4 above.

For the Certificate Template, select Web Server.

In the Additional Attributes box, enter any alternate-domain information in this format:

san:dns=dns.name[&dns=dns.name]

... with &dns=dns.name appended for each alternate domain you want the certificate to handle.

For a single-namespace environment: Enter the autodiscover and root domain, like this:

san:dns=autodiscover.xyzcorp.com&dns=xyzcorp.com

For a multi-/subdomain environment: You can enter as many domains as you like:

san:dns=autodiscover.sub1.xyzcorp.com
&dns=autodiscover.sub2.xyzcorp.com
&dns=autodiscover.sub3.xyzcorp.com
&dns=autodiscover.sub[...].xyzcorp.com
&dns=autodiscover.sub[n].xyzcorp.com

When you are finished, click Submit.

Select the DER encoded radio button, and then select Download certificate chain.

Enter a name for this.

Go back to IIS and click Complete Certificate Request.

For the Filename containing the certification authority’s response, click the Browse button and select the certificate you just saved. (Be sure to change the file type to *.* instead of *.cer, or you won’t see the file you saved—since it is a .P7B extension.) Type a friendly name that is easy to remember and identify so you can find your certificate on the list later. You should then see your new certificate on the list.

Select your new certificate and click View.

Click the Details tab, and scroll down to Subject Alternative Name. Highlight this field, and you should see all of your domains in the Details box.

Now bind your certificate to the HTTPS protocol on the QuestFreeBusy website:

On the CMG F/B computer, in IIS Manager: Select QuestFreeBusy.

In the Actions pane on the right, select Bindings.

Select https and click Edit.

In the Edit Site Binding window, in the SSL certificate drop-down list: Select the certificate you just created.

Click OK.