SSL / VPN set up advise...

Firstly, ensure that your Win2K OS, SQL and ISS servers are completely patched up to date. Also, switch off any services that are not needed. Any servers accessible from outside of your network should be placed in a secured area, separate from the rest of your network, so place the SQL and ISS server(s) in a Demilitarized Zone (DMZ), a separate network hanging off your firewall. In that way, access to and from them can be controlled.
Your ISS sever can indeed generate a public and private key pair. The public key needs to be sent off to a third party such as VeriSign, Thawte or one of the many other external Certificate Authorities. They will verify that your organization is indeed who it claims to be and, if they?re satisfied, they?ll digitally sign you public key, forming a certified public key (AKA certificate). To complete this process, you will need to create the public and private key pairs (you can do this in ISS), form a CSR (Certificate Signing Request) and send it to your chosen CA. When they send you the signed certificate back, you need to add it to your web server.
From now on, when users make HTTPS connections to the pages that you want to protect, they will be sent a copy of that certified public key. Their own software should verify the key (that process is built into the browser) and, once verified, their software creates a value that will be used as the encryption key. This value is itself encrypted using the public key that was received, and the resulting value is sent back to your server. It uses its own corresponding private key to decrypt the value sent. Now both ends have a unique symmetric key and can encrypt and decrypt the data passed between them. There is of course a lot more detail to this process but that it the essence of it. This method of encrypting communications is called SSL (Secure Sockets Layer) and for a more detailed description see http://wp.netscape.com/security/techbriefs/ssl.html.

Thanx for the excellent response Tony. I have visited Verisign, and it seems they will charge approx ?700 for a Server certificate, & ?10 for a client. Do you know this to be correct??. Also sorry to be a pain but did I have the setup correct in the original question in regards to Server - FW - Router etc....

Thanx again for your time, will award points

Gary

You can select a CA such as Verisign to make it official, or use your own CA (not official, nor verifiable).

TCP Port 443 is used for SSL transactions, port 80 for non-SSL transactions, so you'll need to open 443.