Using OWA without SSL is a really BAD IDEA.

I'd probably not use it at all.

Most forget that the OWA credentials are the same as Active Directory, so if someone gets them, they can get into your entire environment.

SSL certs are really cheap these days, even if you don't want to pay Go Daddy $20 a year for one, there are some you can get for free or self sign your own.

It is just too easy to setup and too much of a risk to not have one.

[ Reply to This | # ]