Urgent: Help needed with Exchange SSL certificate

[jamin100]

Hey everyone,

 

So I found out about an hour ago that our SSL certificate has expired.

So the VLE and Exchange 2007 server are now only available locally and not externally, which is no good when the staff are not in school.

 

Having not set this up before im struggling a bit in what goes where etc.

 

Ive just brought a 3 year Standard UCC SSL 5 slot certificate from GoDaddy and am trying to follow the guide here Generating a Certificate Signing Request (CSR) - Exchange Server 2007 | Go Daddy Help | GoDaddy Support but im stuck at step 4. Specifically

 

our FQDN is domain.schoolname.bham.sch.uk so is this what I put in for the FQDN even though our website is just schoolname.bham.sch.uk ?

 

Then I get to this point:

 

[font=Courier New]-domainname[/font] — The comma-separated list of additional domains that are included in your certificate and referred to as Subject Alternative Names (SANs). Deciding what SANs to use depends on the services you are running. [b]You need to know how your server is configured to properly secure everything.[/b] But, depending on your configuration, consider adding the following SANs:
[list]
[*]The external name that people use to send and receive mail: [b]mail.yourdomain.com[/b]. Where [i]yourdomain.com[/i] is your domain.
[*]The Fully Qualified Domain Name: [b]yourdomain.com[/b]. Where [i]yourdomain.com[/i] is your domain.
[*]The local name: [b]yourdomain.local[/b]. Where [i]yourdomain.local[/i] Is the local name of your server.
[*]The name for your Autodiscover services (Autodisover automatically configures profile settings to work with mobile phones and other services): [b]autodiscover.yourdomain.com[/b]. Where [i]yourdomain.com[/i] is your domain name.
[*]To use Outlook Web Access internally, you need to include two NetBIOS names: [b]owa1.yourdomain.local[/b] and [b]owa1[/b]. Where [i]yourdomain.local[/i] is the NetBIOS name of the server.
[/list]

 

so, our VLE and OWA both use https://portal.schoolname.bham.sch.uk is this all I need to add there?

Whats this autodiscover.yourdomain.com? So I need to specify that and how do I tell what mine is?

 

Any help with this would be appreciated as Ive only recently taken over and had no idea this was set to expire

 

Thanks

[jamin100]

Right, just for a bit more info, this is the information from the expired certificate

 

CertificateDomains : {ExchSvr.domain.schoolname.bham.sch.uk}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=School Name CA, DC=domain, DC=schoolname, DC=bham,
                    DC=sch, DC=uk
NotAfter           : 29/12/2013 16:23:52
NotBefore          : 30/12/2011 16:23:52
PublicKeySize      : 2048
RootCAType         : Enterprise
SerialNumber       : 
Services           : IMAP, POP
Status             : DateInvalid
Subject            : CN=ExchSvr.domain.schoolname.bham.sch.uk
Thumbprint         : 

[TomCollins]

An example I found online for the step 4 part was:

 

New-ExchangeCertificate -domainname mail.google.com, google.com, google.local, autodiscover.google.com, server01.google.com, server01 -Friendlyname google.com -generaterequest:$true -keysize 2048 -path c:\certrequest.txt -privatekeyexportable:$true -subjectname "c=US, o=Google Inc., cn=server01.google.com, s=California, l=Mountain View, ou=IT"

 

Source: How to use SSL Certificates with Exchange 2007

 

I admit now I haven't ever had to deal with SSLs in Exchange, however I hope I have helped in some way :-)

[jamin100]

Ok,

 

Do I need a separate certificate for portal.domain.schoolname.bham.sch.uk and exchsvr.domain.schoolname.bham.sch.uk as they seem to have both expired

[TomCollins]

Should be able to just add it onto the --domainname if I'm not mistaken?

[jamin100]

lol, I have no idea.

So, if I add it in -domainname I get the certificate generated and then import it into exchange and then IIS on the sharepoint server?

[TomCollins]

I'm in the same boat as you haha, just trying to think of it logically

 

Was there a separate SSL bought for portal? Might as well try with the --domainname and see what happens, doubt it will hurt adding an extra domain into the SSL, even if it ends up not being able to link to portal.

[jamin100]

No doesn't work.

It says

 

New-ExchangeCertificate : Cannot bind parameter 'DomainName'. Cannot convert value "-PrivateKeyExportable:" to type "Microsoft.Exchange.Data.SmtpDomainWithSub
domains". Error: "Invalid SMTP domain" 

 

If I take out -domainname then it creates the certreq file fine

I should add that im trying to generate this from the exchange management shell in 2007

 

No idea if they were brought seperatly as I only started in September

[jamin100]

Solved this last night.

Didn't need the ssl brought from go daddy as the There is a CA server on the domain capable of issuing certificates.

 

Played with this and eventually got both the VLE and external access to email fixed