Exchange 2007 SSL Cert Generation

[wesleyw]

I need to generate a new SSL cert for our exchange 2007 box however I can't remember what goes where anymore we have a wildcard cert but this isn't allowed by exchange I believe so here the example.

 

Server Name Internally exch.domain.internal, exch (netbios), Externally its exch.school.lea.sch.uk

 

In the following boxes is this right?

 

 

Common Name: exch.domain.internal

 

Subject Alternative Names:

exch.domain.internal

exch

exch.school.lea.sch.uk

 

Organization: our school

Department: IT Services

City:Walsall

State:West Midlands

Country:United Kingdom

Key Size:2048

 

 

 

 

Wes

[ezzauk]

If the cert is being used for you external users web mail, should the common name be exch.school.lea.sch.uk? other wise the cert wont match the url outside the network.

[ezzauk]

Our setup would be somethink like:

 

CN: mail.college.ac.uk

SN: mail.college.ac.uk

ORG: College

Dept: IT Services

City: Redditch

Cou: UK

 

Also you need to import the cert using the powershell:

Import-ExchangeCertificate -path c:\mailcrt.pem | Enable-ExchangeCertificate -Services IMAP, POP, IIS

 

I also had to enable the new cert after i imported it:

 

Enable-ExchangeCertificate -Thumbprint {thumbprint of new cert} -Services IMAP, POP, IIS

 

I hope this helps

[wesleyw]

Well we'll be using the setup internally as well however some may just use the internal name not the external will I have to modify it to allow this?

 

Wes

[ezzauk]

Our internal user use the same url ie mail.college.ac.uk, we dont use the internal url.

[john]

No you will be fine, just make the external work as you can make it a trusted site internally to rid users of warnings thats its an invalid SSL, I did that at work and it didnt' cause any issues and no-one noticed.

 

BUT You may find that with your SAN on your certificate that you may have enough names to put your internal name on it as well which is one way around it, they realise that they dont need to verify exch.school.internal so just approve that bit that may help you out as iwth Exchange 2007 and 2010 you need multiple names on the SSL certificate

[gshaw]

Was looking into this the other week, this site was pretty handy...

 

https://www.digicert.com/easy-csr/exchange2007.htm

[Edu-IT]

From this thread: http://www.edugeek.net/forums/how-do-you-do/25922-how-create-certificate-request-exchange-2007-ucc.html

 

yourdomain.ac.uk

servername.yourdomain.ac.uk

servername

autodiscover.yourdomain.ac.uk

 

So would you not have:

 

domain.lea.sch.uk

exch.school.lea.sch.uk

exch

exch.domain.internal

autodiscover.lea.sch.uk