Exchange must use encryption for Outlook Web App (OWA) access.
An XCCDF Rule
Description
<VulnDiscussion>This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server. The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including Common Access Card (CAC)-enabled preauthentication through an application firewall proxy. Failure to require secure connections on a website increases the potential for unintended eavesdropping or data loss.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-259646r960759_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Ensure a trusted public certificate is installed for the Exchange server with the correct FQDNs that will service the domain. This will allow secure communications between clients and the server. This should be done before the server is put into production.
Once installed, in an elevated Exchange Management Shell, run the following cmdlet to associate the certificate with the IIS service:
Enable-ExchangeCertificate -Thumbprint <thumbprint of public cert> -Services IIS