Exchange 2007 OWA internal access with wildcard security certificate

[rjm]

Hi guys,

 

We have just purchased a wildcard certificate to replace our mail. webserver. and portal. sites, as we are going to publish more sites in the future and it seemed more cost effective. However, I am having problems with Exchange OWA. It used to be secured using mail.school.com security certificate, and is now secured using *.school.com

 

However, internally OWA is accessed by the URL https://internalservername/owa - and it states that is a certificate mismatch as the certificate is trying to secure mail.school.com from the wildcard certificate.

 

This is the bit that gets confusing, when using the old mail.school.com certificate on the OWA site, and accessing https://internalservername/owa the site comes up as secured, even though when you click on the padlock it still says its using the mail.school.com certificate - and the name doesnt match the internal server name.

 

Is there somewhere that a trust between the two is setup, and if so how do I add the wildcard ceritificate to also secure the internal servername address.

 

My other throught was for users to browse to the external site name, which does resolve, but then they get prompted for authentication, which when accessing via the internal addresss then don't - presumably due to autodiscover?

 

Thanks for any help!!

[sukh]

1. Have you assigned the certificate to IIS?

2. Can you post pic of the error or email me?

3.Run Get-ExchangeCertificate | fl >c:\exchcert.txt and post/email

4. What are your internal and external OWA URL's?

[m25man]

Can you not just use Split DNS and create a Zone on your internal DNS server for your external domain name.

 

That way regardless of if you are in or outside the external url would work? It has always worked for me in the past am I missing something since I went to Hosted Exchange?

 

Here is the best link to split DNS in the Interweb

[sukh]

Can you not just use Split DNS and create a Zone on your internal DNS server for your external domain name.

 

That way regardless of if you are in or outside the external url would work? It has always worked for me in the past am I missing something since I went to Hosted Exchange?

 

Here is the best link to split DNS in the Interweb

 

No, you can still use use split DNS and this should work.

[qcomer]

We use a UCC with multiple SANS and add internal and external domains.