Script to configure Exchange Server 2010 for SSLOffloading
2011-09-26 4 Comments
When using a hardware load balancer you sometimes come across the need of configuring Exchange Server to support SSLOffloading. In my case I use a Citrix Netscaler to publish Exchange Server in a scenario where I have enabled SSLOffloading in the Citrix Netscaler. So, in order for this to work configuration changes needs to be done in Exchange Server 2010.
The script below configures both Exchange 2010 RTM and SP1, it also configures basic authentication in IIS for ECP, EWS and OWA.
#
# This script will configure the Exchange 2010 RTM and SP1 Client Access Servers for SSLOffload
# It applies when using Hardware loadBalancer with SSLOffloading enabled
#
# Created by Martin Sundström 2011-09-26
#
#---------------------------------------------------------------------------------------------------------------------------------------------------------
Write-Host -f DarkGray "This script will configure the Exchange 2010 RTM and SP1 Client Access Servers for SSLOffload"
# Set SSLOffload registry key for OWA
Write-Host -f DarkGray -f DarkGray "Setting SSLOffload registry key for OWA..."
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\MSExchange OWA' -Name SSLOffloaded -Value 1 -PropertyType DWORD
Write-Host -f DarkGray -f DarkGray "Done!"
Write-Host -f DarkGray -f DarkGray ""
# Assign Static Ports"
Write-Host -f DarkGray "Assigning static ports..."
# Assign Static Port for MSExchangeAB
New-Item -Path HKLM:\SYSTEM\CurrentControlSet\services\MSExchangeAB -Name Parameters -Type Directory
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\services\MSExchangeAB\Parameters -Name RpcTcpPort -Value 60000 -PropertyType String
# Assign Static Port for MSExchangeRPC
New-Item -Path HKLM:\SYSTEM\CurrentControlSet\services\MSExchangeRPC -Name ParametersSystem -Type Directory
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\services\MSExchangeRPC\ParametersSystem -Name "TCP/IP Port" -PropertyType DWORD -Value 59532
Write-Host -f DarkGray "Done!"
Write-Host -f DarkGray ""
# Disable RequireSSL on websites
Write-Host -f DarkGray "Disabling RequireSSL on websites..."
."$($env:windir)\system32\inetsrv\appcmd" set config "Default Web Site" -commitPath:APPHOST -section:access -sslFlags:None -section:basicAuthentication -enabled:true
."$($env:windir)\system32\inetsrv\appcmd" set config "Default Web Site/Autodiscover" -commitPath:APPHOST -section:access -sslFlags:None
."$($env:windir)\system32\inetsrv\appcmd" set config "Default Web Site/ecp" -commitPath:APPHOST -section:access -sslFlags:None -section:basicAuthentication -enabled:true
."$($env:windir)\system32\inetsrv\appcmd" set config "Default Web Site/EWS" -commitPath:APPHOST -section:access -sslFlags:None -section:basicAuthentication -enabled:true
."$($env:windir)\system32\inetsrv\appcmd" set config "Default Web Site/Microsoft-Server-ActiveSync" -commitPath:APPHOST -section:access -sslFlags:None
."$($env:windir)\system32\inetsrv\appcmd" set config "Default Web Site/owa" -commitPath:APPHOST -section:access -sslFlags:None -section:basicAuthentication -enabled:true
."$($env:windir)\system32\inetsrv\appcmd" set config "Default Web Site/rpc" -commitPath:APPHOST -section:access -sslFlags:None
Write-Host -f DarkGray "Done!"
Write-Host -f DarkGray ""
# Configure Outlook Anywhere
Write-Host -f DarkGray "Configure Outlook Anywhere"
$enabled = Get-OutlookAnywhere -Identity "$($env:COMPUTERNAME)\RPC*"
If ($enabled)
{
Set-OutlookAnywhere -Identity "$($env:COMPUTERNAME)\RPC*" -SSLOffloading $true
}
Else
{
Write-Host -f DarkGray "Configure Outlook Anywhere and remember to check the box to enable SSL Offloading"
}
Write-Host -f DarkGray "Done!"
Write-Host -f DarkGray ""
# This part of the script only applies to Exchange Server 2010 RTM, a version check will be made:
$VersionCheck = ((get-exchangeserver -identity ($env:COMPUTERNAME)).AdminDisplayVersion | Out-String ).StartsWith("Version 14.1")
If ($VersionCheck = $False)
{
# Configure web.config files
Write-Host -f DarkGray "Configuring web.config files for RTM..."
$path = (Get-AutodiscoverVirtualDirectory -Server ($env:COMPUTERNAME)).Path
(Get-Content $path\web.config) | Foreach-Object {$_ -replace "httpsTransport", "httpTransport"} | Set-Content $path\web.config
$path = (Get-WebServicesVirtualDirectory -Server ($env:COMPUTERNAME)).Path
(Get-Content $path\web.config) | Foreach-Object {$_ -replace "httpsTransport", "httpTransport"} | Set-Content $path\web.config
Write-Host -f DarkGray "Done!"
Write-Host -f DarkGray ""
}
# Run IISReset
Write-Host -f DarkGray "Running `"iisreset`" to complete the process..."
iisreset
Write-Host -f DarkGray ""
Feel free to use and edit as you need and don’t hesitate to drop a comment if you find any errors or have any questions!
Martin's Wonderful World of Unified Communications 