Although proper SSL certificates from providers such as Digicert and Verisign have become much cheaper nowadays there are still many occasions when you might prefer to just use a self signed certificate. One of the most common occurences of this is with SBS server, to provide SSL secured web services such as OWA and RPC over HTTP. However the certificate warning you get everytime you open the web site is annoying and maybe confusing for less experienced users. In older versions of IE you could just install the certificate after viewing it but with the improved security in IE7 and IE8 this no longer works. Whilst putting the URL in your "Trusted Sites" list will let you view and import the certificate you will find it is still not properly trusted. The solution is to provide your users with the correct certificate file to install, but its not obvious where you get this from....

So we've got a nice fat ESX server running in our training lab with 20 XP VMs installed on it - and a bunch of barely IT literate users each with a desktop PC that is fully locked down so there is no chance of them screwing anything up. We want to give them access to the XP VMs so they can screw those up instead, e.g. see how much malware they can acquire in 10 minutes of unprotected Internet browsing. That means we can't allow any sort of network connection between our nice safe desktops and these VMs, otherwise we're going to get all that malware coming back into our network, which rules out the obvious candidates like RDP or VNC. What we can do though is connect to the VM consoles as our ESX server is all properly vLANned so the VMs are on one network with an Internet connection but our ESX server and desktops are on a completely separate network.

So how do we get those users connected to those consoles?

We have been using Asterisk for the last four years; it facilitates our distributed model of operation, effectively bridging the gap between traditional PSTN and VoIP. Asterisk enables us to bring important customer calls into our head office via trustworthy ISDN technology whilst at the same time linking branch offices and remote users via VoIP. If we cannot make an outbound call with our SIP and IAX2 trunks, we simply fall back to ISDN.

Many organisations use Asterisk in conjunction with the Trixbox CE distribution to give an excellent administration front-end with FreePBX and good presence management with Hudlite. FreePBX has a poorly documented feature which allows you to separate devices from users. Therefore as users move through our distributed network, they associate themselves with a device by logging in. Calls can transparently be connected with the user rather than using traditional extensions which do not move. Unfortunately Hudlite does not currently support users and devices, forcing us to stay with device only calls if we wish to retain its features.

 We really did not want to make this choice, we wanted rich presence management, integration with messaging, mobility of users and full logging via a searchable database. We therefore decided to look at Microsoft Office Communications Server (OCS). OCS has come on a long way in the last four years and with OCS 2007 R2 just round the corner and the excellent desktop and PDA client, Communicator 2007, it has a promising future.