Exchange must use encryption for Outlook Web App (OWA) access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259646	EX19-MB-000007	SV-259646r942252_rule		Medium

Description
This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server. The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including Common Access Card (CAC)-enabled preauthentication through an application firewall proxy. Failure to require secure connections on a website increases the potential for unintended eavesdropping or data loss.

Description

This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server. The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including Common Access Card (CAC)-enabled preauthentication through an application firewall proxy. Failure to require secure connections on a website increases the potential for unintended eavesdropping or data loss.

STIG	Date
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide	2024-01-10

Details

Check Text ( C-63385r942250_chk )
Open an Exchange Management Shell and enter the following command: Get-ExchangeCertificate \|Select-Object -Property Subject,Services,Thumbprint If the certificate associated with the IIS service is not a trusted public certificate, this is a finding. In the same Exchange Management Shell, run the following cmdlets: Get-OwaVirtualDirectory \| Select-Object -Property internalurl, externalurl If the value returned is not https://, this is a finding. Open IIS Manager and locate the Exchange Server. In the navigation pane on the left, navigate to Sites >> Default Web Site >> owa. In the pane on the right, under /owa Home, in the IIS section, double-click "SSL Settings". If the box "Require SSL" is not checked, this is a finding.

Check Text ( C-63385r942250_chk )

Open an Exchange Management Shell and enter the following command:

Get-ExchangeCertificate |Select-Object -Property Subject,Services,Thumbprint

If the certificate associated with the IIS service is not a trusted public certificate, this is a finding.

In the same Exchange Management Shell, run the following cmdlets:

Get-OwaVirtualDirectory | Select-Object -Property internalurl, externalurl

If the value returned is not https://, this is a finding.

Open IIS Manager and locate the Exchange Server. In the navigation pane on the left, navigate to Sites >> Default Web Site >> owa. In the pane on the right, under /owa Home, in the IIS section, double-click "SSL Settings".

If the box "Require SSL" is not checked, this is a finding.

Fix Text (F-63293r942251_fix)
Ensure a trusted public certificate is installed for the Exchange server with the correct FQDNs that will service the domain. This will allow secure communications between clients and the server. This should be done before the server is put into production. Once installed, in an elevated Exchange Management Shell, run the following cmdlet to associate the certificate with the IIS service: Enable-ExchangeCertificate -Thumbprint -Services IIS Set the OWA URL to use HTTPS instead of HTTP by updating the URLs to HTTPS. If the website is "http://mail.contoso.com" for both internal and external (for example), run the following cmdlet to set it to HTTPS: Set-OwaVirtualDirectory -Identity "\owa (Default Web Site) -InternalUrl "https://mail.contoso.com/owa" -ExternalUrl "https://mail.contoso.com/owa" Note: If this change is made, it must be done for the ECP virtual directory as well. A warning notifies users that this must be done. Open IIS Manager and locate the Exchange Server. In the navigation pane on the left, navigate to Sites >> Default Web Site >> owa. In the pane on the right, under /owa Home, in the IIS section, double-click "SSL Settings". Check the box for "Require SSL".

Fix Text (F-63293r942251_fix)

Ensure a trusted public certificate is installed for the Exchange server with the correct FQDNs that will service the domain. This will allow secure communications between clients and the server. This should be done before the server is put into production.

Once installed, in an elevated Exchange Management Shell, run the following cmdlet to associate the certificate with the IIS service:

Enable-ExchangeCertificate -Thumbprint -Services IIS

Set the OWA URL to use HTTPS instead of HTTP by updating the URLs to HTTPS.

If the website is "http://mail.contoso.com" for both internal and external (for example), run the following cmdlet to set it to HTTPS:

Set-OwaVirtualDirectory -Identity "\owa (Default Web Site) -InternalUrl "https://mail.contoso.com/owa" -ExternalUrl "https://mail.contoso.com/owa"

Note: If this change is made, it must be done for the ECP virtual directory as well. A warning notifies users that this must be done.

Open IIS Manager and locate the Exchange Server. In the navigation pane on the left, navigate to Sites >> Default Web Site >> owa. In the pane on the right, under /owa Home, in the IIS section, double-click "SSL Settings".

Check the box for "Require SSL".