Exchange migration - certificates

[3s-gtech]

Hi guys, Hopefully someone with more nous and experience can help me with this one. I'm migrating Exchange from 2013 to 2016 following this guide Technical Deep Dive: Exchange 2013 to 2016 Migration (Part 3). I have exported the certificates from the 2013 box and imported them into 2016. External DNS (which is all that is used - our own DNS doesn't control the domains used for this cert) still points at the 2013 server. Should I be expecting to see the (still in-date) certificate showing as Invalid on the new server? Will this become valid when DNS is changed over? If I change the DNS resolution using my local hosts file, I can connect to this server and the cert works for the login pages etc. Any pointers or experience you have on this will be welcome!

[chaplic]

Changing the DNS will not fix a broken cert one way or the other

 

did you export it from the Exchange Control panel or through the certifcate MMC? I've seen the former not export the private key which will mean it doesn't work

[3s-gtech]

Exported through Powershell, as on the second page of the guide: Technical Deep Dive: Exchange 2013 to 2016 Migration (Part 2)

$password = ConvertTo-SecureString "Password1" -AsPlainText –Force Export-ExchangeCertificate -Thumbprint CERTIFICATETHUMBPRINT -FileName C:\Exchange2013Cert.pfx -Password $password | Out-Null

Edit: I'm thinking that the PS isn't exporting the private key, as the RootCAType parameter of the cert is showing as 'unknown'. I think I'll just renew it. Edited December 6, 2018 by 3s-gtech

[chaplic]

So on the new box, go into certificate services as local computer, and into the personal certificate store. Locate the cert in question. it should say 'you have a corresponding private key' and you should be able to validate the certificate all the way 'up the chain'

[3s-gtech]

It tells me that I have the private key, and the Certification path shows as okay (cross-checked the same cert on old and new Exchange servers, looks the same on each). On the old one (which still has the corresponding address) it shows as Valid, and it shows as 'Invalid' on the new.

[chaplic]

Bizarre, if you definitely have the correct intermediate certs on the new box I am kinda of out ideas.. I'd probably repeat the process via the GUI an when exporting the cert on the old box tick the box to export all certs in the chain.

 

I also assume the new box can access the internet to validate the chain (proxy could be problematic here),

[3s-gtech]

The new server can access the internet (through a proxy) - it is verifying the chain successfully. It is an odd one. The issue certainly seems to be around the RootCAType field, as it shows as ThirdParty on the old, and Unknown on the new. I'm going to try renewing the cert I think. Edited December 6, 2018 by 3s-gtech

[chaplic]

It can validate the cert through the proxy logged in as you - is a machine level proxy set though? I have been bitten by this before.

[3s-gtech]

Nope! Sorted. I hadn't set the netsh proxy via the command line, so the Local Computer account couldn't get out. We have some traffic that bypasses the proxy, but obviously the cert checking doesn't! Thanks for your help.

[chaplic]

Sweet! glad its sorted.