How To Install an SSL Certificate on MicroSoft Forefront TMG?

Do you want to secure your Microsoft Forefront server using an SSL certificate but don’t know how to accomplish the same or what actions or steps you need to perform? If this is what you are worried about, don’t fret! In this article, we will explore – the step-by-step procedure to install an SSL cert on Microsoft Forefront.

Step 1: Create a CSR.

CSR is an encoded text submitted to your trusted CA (Certificate Authority) that verifies the identity of your company or website. When it comes to creating a CSR for Microsoft Forefront, you have two options:

• Generate it manually using Internet Information Services (IIS) manager in your Windows Server system.
• Use our automatic CSR generation tool.

Once you have submitted the CSR to the CA, it will issue the certificate and send it to your registered email if the validation was successful. The time required to issue a certificate depends upon the type of validation you requested:

• Domain Validation (DV) takes 10-15 mins.
• Organizational Validation (OV) takes 1-3 business days.
• Extended Validation (EV) takes 3-5 business days.

Step 2: Install the SSL Certificate on Microsoft Forefront TMG

To install an SSL certificate on the Forefront TMG server, you need to perform these two steps:

1. Install SSL certificate on Microsoft IIS.
2. Set up a new web listener.

Install SSL certificate on Microsoft IIS

Follow the steps mentioned below to install an SSL certificate on Microsoft IIS:

• Click Search, placed on the taskbar.
• Type IIS Manager and press Enter.
• The Internet Information Services (IIS) Manager window will appear.
• In the Information Services (IIS) Manager perform the following actions:
  • Double-click Server Certificates.
  • In the Actions column, click Complete Certificate Request.
  • The Complete Certificate Request dialog box will appear.
  • In the File name containing the certificate authority’s response field, click the three horizontal dots icon.
  • Browse and select the file with the .cert extension.
  • In the Friendly name field, type a name of your choice.
  • Click OK.
  • Click on your web server.
  • Expand Sites.
  • Select the website that you want to secure with this SSL certificate.
  • In the Actions column, under the Edit Site section, click Bindings.
  • The Site Binding dialog box will appear.
  • Click Add.
  • From the Type list, select https.
  • From the IP address list, select All Unassigned, if necessary.
  • From the Port list, select 443, if necessary.
  • From the SSL certificate list, select the friendly certificate name that you entered above.
  • Click OK.

Note: If you have downloaded the SSL certificate on a separate device from the one where your TMG server is located, you must transfer the SSL and chain certificates (intermediate) along with the Private key to the TMG server machine.

If you need to learn how to do that, refer to the Microsoft article: Configuring Forefront Threat Management Gateway Integration with RD Gateway Step-by-Step Guide.

Set up a New Web Listener

Follow the steps mentioned below to set up a new web listener on the Microsoft Forefront Server:

• Click Search, placed on the taskbar.
• Type Microsoft Forefront and press Enter.
• The Internet Forefront TMG window will appear.
• In the left pane, under the Microsoft Forefront Threat Management Gateway option, expand Forefront TMG.
• Click Firewall Policy.
• In the right pane, click the Toolbox tab if necessary.
• From the New list, select Web Listener.
• The New Web Listener Definition Wizard window will appear.
• In the New Web Listener Definition Wizard window, perform the following actions:
  • In the Web listener name field, type the name of your listener.
  • Click Next.
  • Click the radio button in front of the Require SSL secured connections with clients option.
  • Click Next.
  • Under Listen for incoming Web requests on these networks, select the checkbox in front of the Internal option.
  • Click Select IP Address.
  • Select the radio button in front of the Specified IP addresses on the Forefront TMG computer in the selected Network option.
  • Click Add.
  • Under the Available IP Addresses section, select your IP address.
  • Click Add.
  • Click OK.
  • Click Next.
  • Select the radio button in front of the Use a single certificate for this Web Listener option.
  • Click Select Certificate.
  • From the list, click on the SSL certificate.
  • Click Select.
  • Click Next.
  • From the Select how clients will provide credentials to Forefront TMG list, select No Authentication.
  • Click Next twice.
  • Review your settings and click Finish.
• In the Forefront TMG window, click Apply.
• The Save Configuration Changes window will appear.
• In the Save Configuration Changes window, click OK.

Congratulations! You have successfully installed your SSL certificate on the Microsoft Forefront TMG server.

Test Your Installation

After installing the SSL certificate on your Microsoft Forefront TMG server, the first thing you should do is check whether an SSL system is set up correctly. To do this, you can use SSL testing tools like – SSL Labs.

SSL Labs checks for SSL configuration vulnerabilities and is capable of providing a detailed breakdown of technical information, such as:

• Handshake simulation
• Certificate issuer
• Cipher suites
• Signing algorithms, etc.

Need Help while SSL Installation on Microsoft Forefront TMG?

– Contact Our Support Team or Buy SSL Installation Service