123-reg auto renew SSL .crt certificate won't load in ISA Server, no key, can't export .pfx

We've got an Exchange Server 2003 as part of an SBS 2003 setup, just hanging in on its last couple of months before it gets upgraded - just before the July 2015 sunset on security updates. You best contact redleg.net if you haven't planned upgrading from Server 2003 yet.

The replacement Alpha SSL certificate came as a plain text email, to save as a .crt file and import. Loaded the MMC, added the Certificates option to manage the Local Computer certificate store, and easily imported into the Personal section. From there, head to IIS Manager > Default Website > Properties > Directory Security > Server Certificate and change to the updated certificate.

Easy enough, however on the SBS 2003 Premium, running ISA server as the firewall, you also need to update the certificate in the ISA Outlook web publishing rule too. Right-lick on the rule > Properties > Listener > Properties > Preferences > SSL > Select

But the new certificate doesn't appear on the list. Thats because it needs to be in PFX format, which also includes the private key. This comes from the original certificate request. If you try and export that certificate in PFX format its greyed out, because the private key is missing. There's a quick and easy way to fix the certificate, which doesn't involve exporting or trying to recombine the certificate and key with openssl (yes tried all that!)

Look at the new certificate details and find the serial number - should eb something like a 36 character hex number. Now start a CMD prompt and use the command
   certutil -repairstore my "serialno"

Then go back to ISA to change the certificate attached to the web publishing rule listener and your new certificate should be on the list.

(I also did a restart of IIS Admin service - not sure whether that was required or not - let me know in the comments below)

Access to 1and1 VPS on alternate port 8443 (also 4343) via ISA 2004 server, can't find isa_tpr.zip / isa_tpr.js

One of the hosted management tools is the 1&1 VPS login which uses SSL to port 8443 to login. At one client site they're still using an old ISA 2004 firewall and proxy, which blocks this login.

Adding a rule to allow traffic to 8443 doesn't fix this, you need to allow SSL over port 8443.

There's a good note on isaserver.org, which is probably the best source for this product, however it refers to a download for isa_tpr.js from isatools that is no longer available. After a few dead-ends I found the isa_tpr.zip download on Trend Micro's website. You need to set an SSL port of 4343 for their Worry-Free Business Security (WFBS) console too.

Run these lines in the command prompt of your ISA 2004 server
     cscript isa_tpr.js /add ssl8443 8443
     cscript isa_tpr.js /show

Then restart the Microsoft Firewall service to apply.

Media Player authorisation

Recently put a new SBS2003 R2 Premium server in at a client. We're using the ISA Server 2004 component of Premium to provide monitoring and some internet access control. Someone spotted that you couldn't play video files from itv.com, in particular the British Touring Car Championship (BTCC) ones. They use embedded media player for playback and kept giving an ISA server authorisation prompt.

The ISA logging at the server showed this error:
Denied Connection
SERVER 13/06/2008 09:31:10
Log type: Web Proxy (Forward)
Status: 12209 The ISA Server requires authorization to fulfill the request. Access to the Web Proxy service is denied.

Tracked the fix down to this article http://www.freelists.org/archives/isalist/11-2007/msg00016.html which talked about an error when Media Player tries to resolve the proxy name. With Microsoft ISA Firewall Client installed you can disable the Media Player proxy setting for HTTP (Tools>Options>Network>HTTP>Configure and change from browser to do not use). The Firewall Client will then handle ISA authorisation correctly.

Using the GPO method to apply the change across all PCs made life easy:
"User Configuration\Administrative Templates\Windows Components\Windows Media Player\Networking"
set the "Configure HTTP Proxy" option to "Disabled"