Messaging Gateway

Hi there,

I am wondering if there is a way how to solve the certificate warning if a user access to his own SPAM Qarantine.

Do I need to create a self signed certifcate here:

Certificates
	TLS & HTTPS Certificates Certificate Authority Domain Keys         TLS & HTTPS Certificates Status Expiration No certificates specified.

 

Or is it enough if I select "none specified" here?



My target is to avoid the certificate warning. All our users are accessing internally to their Personal quarantine.


Thanks in advance.

Contonso,

     The best way to avoid this error is to install a valid self signed SSL certificate.

Option #2

Log into the command line interface and enable HTTP
Change the URL in the Spam Quarantine settings to point at port 41080 http instead of 41443 https.


Command to enable http:
cc-config http --on

John,  Won't the user get a cert warning with a self-signed cert?  IE/Firefox etc will not trust a self-signed cert.  Also, while switching to HTTP will elimiante the need for a cert, won't it then pass the users login credentials (which will be his company LDAP id/password), in the clear?

We do not consider clicking the 'View' link in the notification emails a security risk. Please see this document:

Title: 'No login credentials are asked when you click View link in the Quarantine Notification'
Document ID: 2007151145979898
> Web URL: http://service1.symantec.com/SUPPORT/ent-gate.nsf/docid/2007151145979898?Open&seg=ent

When does auth happen?  You need to enable ldap auth to enable per-user quarantines.  The link on the Quarantine setup inlcude https://host:41443/brightmail  I'm asked for my AD ID & password  and restricted to just viewing my quarantine.

SBG 9.0
LDAP with CC Auth enabled
Spam/Quar settings - unchecked Administrator-only Quarantine (directory integration not required).

The document I sent was talking about the 'view' link, not the link to the login URL.

Even if you were to just use HTTP to log in to the interface, that LDAP query is sent in plain text.

Jdavis: Even if you were to just use HTTP to log in to the interface, that LDAP query is sent in plain text.

What LDAP Q?  The encryption ot the LDAP query should be between the SBG and the LDAP source, and SBG 9 can encrypt that via SSL/LDAP.

If the user login page is HTTP, is the forms data between the user and the SBG box encrypted?

If he was encrypting the data between his LDAP server and the Appliance he would already have an SSL certificate.

None of that data would be encrypted.