pritchardavid Posted June 8, 2011 Posted June 8, 2011 Hi there I have an annoying problem here I create a certficate request in Exchange 2010 console Paste the code on the ipsca website and send the request off to them When I recieve the certificates I have been told your meant to instal l the two files below in these locations. But when I tried to install the ipsCA LEVEL 1 CA I could not install it to that location, the local computer directory was midding, so had to install it to the root of 'Imtermedicate cert authorities' Would that cause a problem? I have had the Active Directory Cerftificate Services installed on this box before, through I might need to use it. Would that be a cause of it missing the directory? ipsCA LEVEL 1 CA click it to install -> place all certs in following store -> tick 'show physically stores' -> Intermediciate cert authorities -> local computer same for ipsCA GLOBAL CA ROOT but -> trusted root cert authories -> local computer I press complete certicate in Exchange 2010 console, but after this the problem happens. I then get this error 'the certificate for this server is invalid for exchange server usage' Any ideas guys?
IKWeb Posted June 8, 2011 Posted June 8, 2011 Hi is this SSL for OWA?? If so, I had mega issues doing the SSL cert from the Exchange console. So I did the SSL crent though IIS and this worked fine 1st time... So if the SSL is for OWA can you not do it via IIS?
pritchardavid Posted June 8, 2011 Author Posted June 8, 2011 Yes this is for OWA I did try creating and completing a certificate from IIS, but had the same dreaded error message 'the certificate for this server is invalid for exchange server usage'
FN-GM Posted June 8, 2011 Posted June 8, 2011 Sorry to hijack how long did your certificate take to arrive? I ordered one first thing yesterday got an approval e-mail and still waiting on it. Thanks
pritchardavid Posted June 8, 2011 Author Posted June 8, 2011 About a day, requested it in the moring and get it later that evening
IKWeb Posted June 8, 2011 Posted June 8, 2011 Guess it depends on who you go though. I did an install in a school in Islington last month, ordered the SSL though GoDaddy, got the email to the registered email address for the domain name, clicked on the links to authorise, and got the SSL cret within about 10min. Total time. 40min max from getting the information from IIS, to getting the SSL from Godaddy, and installing it in IIS.
FN-GM Posted June 8, 2011 Posted June 8, 2011 Guess it depends on who you go though. I did an install in a school in Islington last month, ordered the SSL though GoDaddy, got the email to the registered email address for the domain name, clicked on the links to authorise, and got the SSL cret within about 10min. Total time. 40min max from getting the information from IIS, to getting the SSL from Godaddy, and installing it in IIS. The difference is IPS are free
IKWeb Posted June 8, 2011 Posted June 8, 2011 Yes this is for OWA I did try creating and completing a certificate from IIS, but had the same dreaded error message 'the certificate for this server is invalid for exchange server usage' What type of SSL cret did you get? can you give a link to the product??
IKWeb Posted June 8, 2011 Posted June 8, 2011 The difference is IPS are free You cant beat free... But GoDaddy, are selling SSL certs for £8 per year, so there we go... Get a free one, you end up waiting, as you have :-( or pay £8 per year, and get it all done and setup within 40min hmmmm tuff choice. lol
pritchardavid Posted June 8, 2011 Author Posted June 8, 2011 What type of SSL cret did you get? can you give a link to the product?? SSL Certificate Authority low-cost, fully-validated 38$ SSL and 276$ Wildcard Certificates A1 SSL Certificate When Filling out the form I selected Exchange for the server type unless im meant to select IIS 7.5?
IKWeb Posted June 8, 2011 Posted June 8, 2011 I can only comment on the way I did the setup, I selected IIS for mine, as I coundt get the exchange one to work.
pritchardavid Posted June 8, 2011 Author Posted June 8, 2011 (edited) Did you manage to install the ipsCA LEVEL 1 CA cert to Intermediciate cert authorities -> local computer? I couldnt install it to local computer ,it was not there to select, hense i just had to install it to the root of Intermediciate cert authorities instead Maybe thats the problem? Cause it cant identifity that cert because its ibeen installed in the wrong place? The only reason I can think why that location is not there to select is because this server was a CA (Active Directory Cerficate Services), has been removed since. Managed to install the SSL cert for our Remote Desktop Server which was not a CA (AD CS) Gusse I will have to contact ipsca support, see what they say Edited June 8, 2011 by pritchardavid
PiqueABoo Posted June 8, 2011 Posted June 8, 2011 I'm sure you need to put these certs in the computer store, if you haven't they're probably in Administrators's store and none of the exchange services can access them How about running mmc, add a snap-in, select "certificates", select 'computer account' etc. Does that work? If so then can you then r-click the relevant store name from their instructions and import whatever cert files you've been given?
irsprint84 Posted June 8, 2011 Posted June 8, 2011 I can have another look tomorrow for you, didnt you right click 'complete cert' ? did you 'enable' it?
sukh Posted June 8, 2011 Posted June 8, 2011 (edited) 1. Check your cert > run Get-ExchangeCertificate |fl >c:\cert.txt from the ems and check status 2. run Enable-ExchangeCertificate certificate -services IIS in the ems 3. Confirm is it a UCC cert 4. Make sure you have put the cert in the right place 5. Check the purpose of the cert 6. What base OS are you using inclu SP, 2008 or r2? Sukh Edited June 8, 2011 by sukh
pritchardavid Posted June 9, 2011 Author Posted June 9, 2011 yer thats what I done again, this is really annoying me now, it should just work, im doing everything correct here
sukh Posted June 27, 2011 Posted June 27, 2011 1. Check your cert > run Get-ExchangeCertificate |fl >c:\cert.txt from the ems and check status 2. run Enable-ExchangeCertificate certificate -services IIS in the ems 3. Confirm is it a UCC cert 4. Make sure you have put the cert in the right place 5. Check the purpose of the cert 6. What base OS are you using inclu SP, 2008 or r2? Sukh Got this info?
pritchardavid Posted June 28, 2011 Author Posted June 28, 2011 (edited) Right, this is what I have done now (Trying to follow your instuctions sukh) Request a certificate from the Exchange Console Request a certificate from ipsca again Renamed the cert file from ipsca, to cert.txt so it works with your command Now used your commands in the Exchange 2010 Shell This is an error im getting VERBOSE: Connecting to MAIL.ockendon.thurrock.sch.uk VERBOSE: Connected to MAIL.ockendon.thurrock.sch.uk. [PS] C:\Windows\system32>Get-ExchangeCertificate |fl >c:\cert.txt Thats command works but does nothing as far has I can tell [PS] C:\Windows\system32>Enable-ExchangeCertificate certificate -services IIS The certificate with thumbprint certificate was not found. + CategoryInfo : ObjectNotFound: ( [Enable-ExchangeCertificate], InvalidOperationException + FullyQualifiedErrorId : 79C4D1AB,Microsoft.Exchange.Management.SystemConfigurationTasks.EnableExchangeCertificate Was I meant to install the certificate in the Echange Console before doing these commands? Edited June 28, 2011 by pritchardavid
sukh Posted June 28, 2011 Posted June 28, 2011 1. Yes, you have to import the cer then enable on the services. 2. You dont need to rename the cert .txt, that was for the output 3. What format did you get yuo cert in pfx p12 cer?
pritchardavid Posted June 28, 2011 Author Posted June 28, 2011 (edited) Have found one problem I think Once I looked at the cert.txt - Root CA Type Unknown Also when I done the second command nothing happend I typed this is for the second one - Enable-ExchangeCertificate 06E0D7CFE246DC6FD05491F1A9270B5424DC905E -services IIS -DoNotRequireSSL (Last command is to stop enforcing SSL at the root, as we redirect it to owa at the root which is not https) Purpose of the cert = Ensures the identity of a remote computer AccessRules : {System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessR ule} CertificateDomains : {mail.theockendonacademy.com} HasPrivateKey : True IsSelfSigned : False Issuer : [email protected], CN=ipsCA Level 1 CA, OU=Certificaciones, O=ips Certification Authority, L =MADRID, S=MADRID, C=ES NotAfter : 02/07/2013 15:22:13 NotBefore : 27/06/2011 15:22:13 PublicKeySize : 2048 RootCAType : Unknown SerialNumber : 10A8E3BBFA2DE210C590D8B8AB78D150668C41E8 Services : None Status : Invalid Subject : CN=mail.theockendonacademy.com, OU=ICT, O=The Ockendon Academy, L=South Ockendon, S=Essex, C=GB Thumbprint : 06E0D7CFE246DC6FD05491F1A9270B5424DC905E Edited June 28, 2011 by pritchardavid
sukh Posted June 28, 2011 Posted June 28, 2011 1. For what reason are you installing the Cert if youre using http and not https? 2. If you got to mail.theockendonacademy.com can you login succesfully and use OWA?
pritchardavid Posted June 28, 2011 Author Posted June 28, 2011 (edited) Sorry got you a bit confussed there, we are using https. We just dont use it on the root, so when you type in mail.theockendonacademy.com it redirects you to https://mail.theockendonacademy.com/owa Ok have got a bit further now, noticed that the ipsCA LEVEL 1 CA was missing from 'Intermediciate cert authorities' store, sure I have checked this before the the mmc addon. New info from cert.txt AccessRules : {System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessR ule} CertificateDomains : {mail.theockendonacademy.com} HasPrivateKey : True IsSelfSigned : False Issuer : [email protected], CN=ipsCA Level 1 CA, OU=Certificaciones, O=ips Certification Authority, L =MADRID, S=MADRID, C=ES NotAfter : 02/07/2013 15:22:13 NotBefore : 27/06/2011 15:22:13 PublicKeySize : 2048 RootCAType : ThirdParty SerialNumber : 10A8E3BBFA2DE210C590D8B8AB78D150668C41E8 Services : IIS Status : Valid Subject : CN=mail.theockendonacademy.com, OU=ICT, O=The Ockendon Academy, L=South Ockendon, S=Essex, C=GB Thumbprint : 06E0D7CFE246DC6FD05491F1A9270B5424DC905E But a problem still exists! Im getting 'this certificate cannot be verified up to a trusted certification authority' on the owa site when I click on the cerficate error Plus when I click to view the cerficate and click on the cerfication path, it does not have any cerficates expect mail.theockendonacademy.com. It's missing bothe the root and level 1 ipsca certs Edited June 28, 2011 by pritchardavid
sukh Posted June 28, 2011 Posted June 28, 2011 1. Did you get a root certificate too when you cert was issues to you, the full path isnt avaliable, this is why youre getting the error. The root exisits in the browser but it seems liek you have a Intermediate?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now