best/secure way to access webclient from web?

[glenndm]

Hi,
My boss just asked me to provide a laptop from which he can access his email remotely. As I already pushed him to the zimbra webclient instead of outlook (still chafes occasionally), I gather his demand translates into providing a secure access to the zimbra server's webpage.
Could SSH tunneling to the server on some high port a solution?
the ssh keys will be preloaded on the laptop (of course he hates typing/remembering passwords)
A guide or stepbystep description would also help me enormously

regards
glenn

[uxbod]

What is wrong with HTTPS to the web client ? Alternatively you could always setup a VPN link into your LAN.

[veronica]

HTTPS works in secure way. Why not use it

[glenndm]

thank to the both of you.
I'll need to refresh my https knowledge then.
For user authentication, do I need a 3rd party certificate per user or will self-signed ones do?

[y@w]

That really depends upon your users' requirements. If you don't mind that they have to click a few buttons to accept a self-signed certificate warning in their browser then there's really no reason that you need to purchase a certificate and the self-signed one will do.

[glenndm]

You immediately hit the weak point! I don't mind, but THEY will!
thanks

[uxbod]

Then get them to purchase a commercial certificate

[glenndm]

thanks to your replies (and gentle chiding) here, the mail can now be consulted remotely.
It was surprisingly easy, albeit with extra twist courtesy of our ISP
1. ask the domain hosting co to add a cname record to the dyndns ext. name
2. add router rule forwarding a external high port to the server 443 port
(1,2 because ISP will only sell static IP and open 443 port at exorbitant high prices)
3. restart zimbra in https only mode (zmtlsctl)
4. add exceptions for selfsigned cert in firefox
5. open https://cname:highport

and presto, zimbra is here (and way over there )

Just one follow-up question:
Can I disable the automatic sending of the certificate by the server?

I'd like install the certificate manually on the laptops.
Incoming requests to the server would not get even to the login screen if the certificate is not already present on the caller's machine.

best regards
glenn