New Certificate Problem

[pritchardavid]

I have got a new certificate today for our remote servers from ipsca

I made the subject name remote.{domain}.com

Also the other names (SAN)

remote
remote01
remote02
remote01.{domain}.com
remote02.{domain}.com

Now im getting 'windows does not have enough information to verify this certificate' errors under the security details
This happen an all of the names above when I remote to the server

The only time this doesnt happen is when I remote on the server using the 'remote' server name. With this I get 'the server name on the certificate is incorrect' (name in the cerificate from the remote computer) 'remote'

Why is there a problem?

Both servers have this certificate installed in under personal and remote in the cert mmc. And also activated in the remote host settings and remote app.

the name of the farm is remote.theockendonacademy.com
the name of our website is theockendonacademy.com
the name of our domain is theockendonacademy.com

So we should be able to connect to any of the two servers using eithier
- remote
- remote.{domain}.com
- remote01
- remote01.{domain}.com
- remote02
- remote02.{domain}.com


Any ideas?

Many thanks

[pritchardavid]

Ok, im silly, just a restart of the server done the trick.

EDIT: Ok maybe not completey solved

Still getting 'the server name on the certificate is incorrect' when I remote into the server(s) as remote.{domain}.com

Would it help adding remote.{domain}.com to Subject Alternative Name Section, even through it's on the sybject name.

It's just that everything else is working that's on the Alternative Name Section.

[Flora]

Have you got a wildcard certificate, which allows you to use the certificate to protect: anything_here.{domain}.com. A normal certificate will only protect fixed_name@{domain}.com.

John.

[pritchardavid]

Thanks, but I did solve this

Apprentlly if you use SAN names you need to enter the one on the subject because it gets bypassed.


With exchange 2010 do you have to use the exchange certificate wizard, done mine through iis, but when I installed the new cert and when into the exchange manager it was missing iis in the available services for the new cert (had everything else through)

[sukh]

you need to have the common name as remote.{domain}.com

Creating via IIS is not supported, you have to do it via EMC or EMS.