New Certificate Problem

[pritchardavid]

I have got a new certificate today for our remote servers from ipsca

 

I made the subject name remote.{domain}.com

 

Also the other names (SAN)

 

remote

remote01

remote02

remote01.{domain}.com

remote02.{domain}.com

 

Now im getting 'windows does not have enough information to verify this certificate' errors under the security details

This happen an all of the names above when I remote to the server

 

The only time this doesnt happen is when I remote on the server using the 'remote' server name. With this I get 'the server name on the certificate is incorrect' (name in the cerificate from the remote computer) 'remote'

 

Why is there a problem?

 

Both servers have this certificate installed in under personal and remote in the cert mmc. And also activated in the remote host settings and remote app.

 

the name of the farm is remote.theockendonacademy.com

the name of our website is theockendonacademy.com

the name of our domain is theockendonacademy.com

 

So we should be able to connect to any of the two servers using eithier

- remote

- remote.{domain}.com

- remote01

- remote01.{domain}.com

- remote02

- remote02.{domain}.com

 

 

Any ideas?

 

Many thanks

Edited November 15, 2012 by ZeroHour

[pritchardavid]

Ok, im silly, just a restart of the server done the trick.

 

EDIT: Ok maybe not completey solved

 

Still getting 'the server name on the certificate is incorrect' when I remote into the server(s) as remote.{domain}.com

 

Would it help adding remote.{domain}.com to Subject Alternative Name Section, even through it's on the sybject name.

 

It's just that everything else is working that's on the Alternative Name Section.

Edited November 15, 2012 by ZeroHour

[Flora]

Have you got a wildcard certificate, which allows you to use the certificate to protect: anything_here.{domain}.com. A normal certificate will only protect fixed_name@{domain}.com.

 

John.

Edited November 15, 2012 by ZeroHour

[pritchardavid]

Thanks, but I did solve this

 

Apprentlly if you use SAN names you need to enter the one on the subject because it gets bypassed.

 

 

With exchange 2010 do you have to use the exchange certificate wizard, done mine through iis, but when I installed the new cert and when into the exchange manager it was missing iis in the available services for the new cert (had everything else through)

[sukh]

you need to have the common name as remote.{domain}.com

 

Creating via IIS is not supported, you have to do it via EMC or EMS.

Edited November 15, 2012 by ZeroHour