Dos_Box Posted October 30, 2008 Posted October 30, 2008 This will be of some use to those of you thinking of moving to Exchange 2007 in the near future and allowing external access to Outlook Web Access and other features. Because Exchange 2007 relies of a different certificate type, the Unified Communications Certificate, which has 'alternative' credentials i.e. the certificate contains multiple host names. As you will have to order your certificate online you will first need to generate the certificate request, and Microsoft wanting to make things easy insist that you have to use the Exchange Management Shell to generate it. You should use the following command (ensuring you are logged on as an Exchange administrator): New-ExchangeCertificate -GenerateRequest -SubjectName "C=GB, O=servername, CN=exchange.yourdomain.ac.uk" -Path c:\certreq.req This should generate the text you need to paste into the online order form. The forms should also ask you for the alternative names you will need. These should reflect the server name, domain name, external FQDN name and the new 'autodiscover' url as shown below: yourdomain.ac.uk servername.yourdomain.ac.uk servername autodiscover.yourdomain.ac.uk webalias.yourdomain.ac.uk (in case you use a reverse proxy or different external name for your server) These reflect the services and roles both internal and external that Exchange 2007 uses SSL for. I just thought you should be aware of all of this before you begin to migrate. 2
Dos_Box Posted November 3, 2008 Author Posted November 3, 2008 It was hell. There is a LOT that you need to do before Exchange 2007 wants to play correctly, and most of it seems to be undocumented. Microsoft, as usual were excellent with their professional support, but the big one is that people need to be aware they need the correct certificate (the UCC cert) or else it simply won't bother to do everything you need it to.
Friez Posted November 4, 2008 Posted November 4, 2008 It was hell. There is a LOT that you need to do before Exchange 2007 wants to play correctly, and most of it seems to be undocumented. Microsoft, as usual were excellent with their professional support, but the big one is that people need to be aware they need the correct certificate (the UCC cert) or else it simply won't bother to do everything you need it to. Quoted for truth, Exchange 2007 is a nightmarish setup, especially with regards to certificates, let alone the fact that you MUST run it on 64bit machines, and all the other fiddly pre-requisites required.
Ben_Stanton Posted November 4, 2008 Posted November 4, 2008 Despite all of the above, I LOOOOVE it! But then I didn't really migrate from an existing email server. I literally left the old 'mailgate/eudora' shite running as a legacy server. Simply telling everybody it will be there for a year for archival purposes and that is it. As of whateber date, outlook and exchange is what we will be using. Was accepted surprisingly well
FragglePete Posted March 16, 2009 Posted March 16, 2009 Sorry to drag up an old thread. Just installed Exchange 2007 at the moment, and now just getting the external OWA access working so sorting out certificates and stuff. Useful info from Dos_box regarding requesting the certificate, which is detailed quite nicely here: https://support.comodo.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=1143 However, can someone clear something up for me. Is this just what I need, or do I need an additional certificate for the IIS Side of things? Or will a UCC Certificate look after all of it for me? Reading all the books that I have go on about installing a SSL Certificate within the IIS Manager, and don't really mention the procedure that is detailed above. Thanks in advance. Pete
Dos_Box Posted March 16, 2009 Author Posted March 16, 2009 A universal communications certificate is an SSL cert that allows you to have multiple entries for all names (internal and external) that you connect to your exchange server with. You simply install the certificate at the root of your exchange servers IIS and it will cover everything. If you are using Server 2008 and IIS look for the 'Bindings' option on the R\H\S of the IIS layout. You use this to change the SSL certificate being used. 1
FragglePete Posted March 16, 2009 Posted March 16, 2009 Thanks, found this quite useful as well...... https://www.digicert.com/easy-csr/exchange2007.htm Creates your CSR Command for you. Pete
rusty155 Posted April 22, 2009 Posted April 22, 2009 Great info here - just out of interest for those of you that have them, where did you get your UCC from and roughly how much did you pay (if you don't mind sharing!). Thanks.
pooley Posted April 27, 2009 Posted April 27, 2009 Got our with "Go Daddy" https://www.godaddy.com/gdshop/ssl/ssl.asp for around £180 for 3 years
FragglePete Posted April 27, 2009 Posted April 27, 2009 Got ours from SSL Certificates SSL Wildcard SSL Free Certificates SSL Server Certificate 256 bits which is free for education domains. Not entirely convinced it's a proper UCC certificate, but I generated the request as detailed above and have managed to get it working with our Exchange 2007 box (eventually). OWA is secured quite nicely with 2048bit encryption Pete
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now