in a muddle with exchange 2010 sp1 (owa and certificates)

[sacrej]

okay the issue I have been having is that when the outlook client connects to the server, it is looking for the exchange2010.domainname.local certificate, now for our web app address we have just https://exchange2010 - this is for internal use only.

 

the problem is, if I assign a certificate with the name 'exchange2010' web app will work, but the outlook client will kick out a ton of errors. at the moment clients cannot access https://exchange2010.domainname.local/owa in their browser, only the shorter name.

 

what is the best way to do this?

 

I also try creating a second binding in IIS with the port 443 with the exchange2010 certificate attached to it, this works perfectly, except for the fact that I get an error when deleted messages in OWA "An unexpected error occurred and your request couldn't be handled."

 

any suggestions, as i'm banging my head against the wall at the moment.

 

I have -

-checked the virtual directory auth options with reference to the EHLO exchange dev websites advice

-set the exchange2010.domain.local certificate to IMAP,POP and SMTP

-set the exchange2010 certificate to "IIS"

-got forms authentication setup

 

 

help:confused:

 

edit* if it helps these are the errors i'm getting in the exchange event log with regards to deleting messages

 

WebHost failed to process a request.

Sender Information: System.ServiceModel.ServiceHostingEnvironment+HostingManager/30542218

Exception: System.ServiceModel.ServiceActivationException: The service '/EWS/exchange.asmx' cannot be activated due to an exception during compilation. The exception message is: This collection already contains an address with scheme http. There can be at most one address per scheme in this collection.

Parameter name: item. ---> System.ArgumentException: This collection already contains an address with scheme http. There can be at most one address per scheme in this collection.

Parameter name: item

at System.ServiceModel.UriSchemeKeyedCollection.InsertItem(Int32 index, Uri item)

at System.Collections.Generic.SynchronizedCollection`1.Add(T item)

at System.ServiceModel.UriSchemeKeyedCollection..ctor(Uri[] addresses)

at System.ServiceModel.ServiceHost..ctor(Type serviceType, Uri[] baseAddresses)

at System.ServiceModel.Activation.ServiceHostFactory.CreateServiceHost(Type serviceType, Uri[] baseAddresses)

at System.ServiceModel.Activation.ServiceHostFactory.CreateServiceHost(String constructorString, Uri[] baseAddresses)

at System.ServiceModel.ServiceHostingEnvironment.HostingManager.CreateService(String normalizedVirtualPath)

at System.ServiceModel.ServiceHostingEnvironment.HostingManager.ActivateService(String normalizedVirtualPath)

at System.ServiceModel.ServiceHostingEnvironment.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath)

--- End of inner exception stack trace ---

at System.ServiceModel.ServiceHostingEnvironment.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath)

at System.ServiceModel.ServiceHostingEnvironment.EnsureServiceAvailableFast(String relativeVirtualPath)

Process Name: w3wp

Process ID: 468

 

 

and

 

 

Outlook Web App couldn't connect Exchange Web Services due to a configuration error. Response code = "500".

 

so something to do with EWS

Edited October 12, 2010 by sacrej
additional info

[sacrej]

so deleting the additional ssl port (447) allows things to be deleted in owa again, but means I will need to find an alternate solution, its definitely something to do with EWS not liking more than one ssl in its settings

[timzim]

Do you not have to add IIS to the roles for the exchange2010.domain.local certificate?

[sacrej]

okay, the only way we seem to be able to do it is to have *.domain.local in every computers 'ignore proxy' list and use https://exchange2010.domain.local/owa, I can do this for an individually logged in user, but what is a quick and easy way to do this for all users? I have tried pushing via policy, but no joy :/

 

we have Forefront TMG by the way

[PiqueABoo]

Are your DCs 2008 [R2]? If so use GPP to handle all your IE settings, including proxy exceptions.

[timzim]

Ah, you're logging in via Forefront TMG. If it's anything like ISA you'll need separate rules for internal and external - one listens internally, the other externally. Each rule has its own listener and each listener its own certificate, appropriate for the url being typed. Both rules are otherwise identical.