sidewinder Posted January 30, 2012 Posted January 30, 2012 We run an Exchange 2010 SP1 server and mostly Outlook 2007 clients, with a few Outlook 2010. When I initially set it up, I used a self signed cert for everything, this of course meant a warning on OWA and also a warning the first time with Outlook 2010, which I assume would eventually be solved by installing an internal CA. However I bought a wildcard SSL certificate to use with OWA and installed it. I set the binding in IIS for port 443 to use the new cert, works fine externally. But now internal Outlook clients (even 2007) bring up a prompt saying the server name does not match the certificate - and when you view the certificate it is the one for mail.schoolname.org so no wonder it is complaining. I still have the self signed cert on the server, so how do I set it so Outlook uses that rather than the external one? I have read a lot about internal URL paths this afternoon which can apparently produce this error, but when I have checked these settings in the EMC they all seem to reference the internal FQDN so I'm not sure that is the problem here?
pritchardavid Posted January 30, 2012 Posted January 30, 2012 Has you brought a wildcard cert for you domain it wouldnt match the internal name of the exchange server for example My internet address of our exchange is mail.theockendonacademy.com Our server is called for example mail or exchange Now they certificate you have will only match the outside world address, so anything for *.theockendonacademy.com For the internal address i would find *.theockendonacademy.com eithier but the internal domain name is diffrent and that it doesnt you the domain address at the end So you need *.theockendonacademy.com (outside) mail (inside) This is why I wouldn't get a wildcard for exchange, I would have got a SAN certificate. or it could be the case that you need to setup your outlook users to use you outside address instead of the internal address if possible I think this is your problem, hope that helps
pantscat Posted January 30, 2012 Posted January 30, 2012 You could just put add an A record to your internal DNS that points mail.schoolname.org to the internal IP address of your exchange server... I'd make sure that your exchange server was looking at an external DNS server for name resolution though...
sidewinder Posted January 30, 2012 Author Posted January 30, 2012 Thanks, I was thinking that would be the problem. Bought the wildcard cert thinking it would cover this and our sharepoint server Only found out about SAN certs today...oh well, live and learn I would imagine that setting the external address to resolve internally just to be able to use the same certificate is probably not a great idea?
sidewinder Posted January 30, 2012 Author Posted January 30, 2012 You could just put add an A record to your internal DNS that points mail.schoolname.org to the internal IP address of your exchange server... I'd make sure that your exchange server was looking at an external DNS server for name resolution though... Makes sense, but yes it is a bodge, cautious as it adds a layer of complexity for no reason apart from saving money (and making the most of me buying the wrong cert)
pantscat Posted January 30, 2012 Posted January 30, 2012 No - probably not the best idea. A SAN certificate would be a much neater way of doing it.
Domino Posted January 30, 2012 Posted January 30, 2012 You'll also need to set internal and external names for all these services, mostly in the excahnge sheel: Exchange 2007/2010 Web services and Autodiscover Ultimate Troubleshooting Guide And in the EMC set the services attached to each cert by going to 'server configuration' and clicking the servername for the server you want to manage. then clicking the cert and attaching services been having this fun with loadbalanced CAS roles recently ;-)
sidewinder Posted January 30, 2012 Author Posted January 30, 2012 Would this be ok? QuickSSL® Premium For Only £68.00 - Secure Mobile Devices, Issued Within Minutes, Free GeoTrust® Site Seal (UK) Or is there something cheaper? TrustICO were who I ordered the wildcard cert from, bit annoying as that costs about £130 compared to £30 for a single server cert but at least I only purchased for a year!
pete Posted January 30, 2012 Posted January 30, 2012 Would this be ok? QuickSSL® Premium For Only £68.00 - Secure Mobile Devices, Issued Within Minutes, Free GeoTrust® Site Seal (UK) Or is there something cheaper? TrustICO were who I ordered the wildcard cert from, bit annoying as that costs about £130 compared to £30 for a single server cert but at least I only purchased for a year! Just ensure you've enough SANs (you get 3 with that cert - so realname.fqdn + 3 others) Ours is valid for: mailserver.internaldomainname.school.region.sch.uk With SANs for: webmail.school.region.sch.uk autodiscover.school.region.sch.uk autodiscover.internaldomainname.school.region.sch.uk mailserver.school.region.sch.uk Autodiscover.* is for Outlook clients 1
pritchardavid Posted January 30, 2012 Posted January 30, 2012 are you working for a school? you can get free san certs from ipsca, like I have done 2
sidewinder Posted January 31, 2012 Author Posted January 31, 2012 Just ensure you've enough SANs (you get 3 with that cert - so realname.fqdn + 3 others) Ours is valid for: mailserver.internaldomainname.school.region.sch.uk With SANs for: webmail.school.region.sch.uk autodiscover.school.region.sch.uk autodiscover.internaldomainname.school.region.sch.uk mailserver.school.region.sch.uk Autodiscover.* is for Outlook clients Our external is mail.schoolname.org and that is the only one we use externally, would 3 not be enough in our case?
sidewinder Posted January 31, 2012 Author Posted January 31, 2012 are you working for a school? you can get free san certs from ipsca, like I have done Yes but we're an independent school, would they still issue one?
sidewinder Posted January 31, 2012 Author Posted January 31, 2012 Also I'm assuming from the responses there is no way to continue using a self signed cert for internal Outlook clients and the wildcard cert just for OWA? I have both installed on my exchange server
sukh Posted February 3, 2012 Posted February 3, 2012 1. Use an Internal CA or a 3rd party cert. 2. If using a 3rd party cert, configure your internal and external URL to the same namespace. 3. Easy thing would be to get SAN cert and include the FQDN of your exch server.
FragglePete Posted February 3, 2012 Posted February 3, 2012 Yes but we're an independent school, would they still issue one? Don't see why not, give it a go, just apply for one. They manually check the education certs so takes a little longer (a few hours), but if your education, why not. Pete
pritchardavid Posted February 3, 2012 Posted February 3, 2012 (edited) Yes but we're an independent school, would they still issue one? Yep any educational institution for a san cert, you need to create the the cert request (so for you in exchange with at the end of the wizard you should have all you san names) apply for the cert order order, has soon as soon as you get your cert order email with the order number make a support ticket and state you would like a free san cert and write down the following san name you need along with your order number. Edited February 3, 2012 by pritchardavid
chazzy2501 Posted April 8, 2013 Posted April 8, 2013 (edited) help, I'm about to make a cert request but need some pointers on the last few fields. I've half filled it in but I think I need to make an ldap request to make sure I fill in the last few fields correctly. New-ExchangeCertificate -GenerateRequest -DomainName bemail.beaminster.dorset.sch.uk, autodiscover.beaminster.dorset.sch.uk, exchange.dcc-sch-4505.local, exchange -FriendlyName beaminsterschexchange -KeySize 1024 -PrivateKeyExportable:$True -SubjectName "c=US o=contoso inc, CN=server01.contoso.com" -Path c:\certrequest.txt c should equal UK? o ? I can't find organisation in Active directory? cn should equal the servers local or public name? external name bemail.beaminster.dorset.sch.uk internal name exchange.dcc-sch-4505.local I don't have the autodiscover service working (I think) but I don't see the harm in including it. All my 2003 and 2010 outlook clients work fine as do the owa clients. I have to set them up by hand but no biggie. Edited April 8, 2013 by chazzy2501
pritchardavid Posted April 8, 2013 Posted April 8, 2013 (edited) Personally I would not do it this way. I would advise you if you haven't all ready is to add "beaminster.dorset.sch.uk" as a DNS zone in your internal DNS server(s). Add the bemail as a A Record in that zone. You can then configure your Exchange server to use the same name internally and externally (bemail.beaminster.dorset.sch.uk), this will make it a ton easier being the same. Personally to make sure you have not gone wrong with powershell code, you can create the SSL cert the the Exchange console. Edited April 8, 2013 by pritchardavid
chazzy2501 Posted April 8, 2013 Posted April 8, 2013 @pritchardavid Yes, that is the way for single name certs. Which I now realize I have todo as the UC certs are not free Do I have to setup a DNS Zone? I can already ping bemail.beaminster.dorset.sch.uk locally and get the local ip address. (and I can RDP to it using bemail) This may upset my outlook clients as they connect to exchange.dcc-sch-4505.local ? cheers
pritchardavid Posted April 10, 2013 Posted April 10, 2013 What is your internal domain? Is it... dcc-sch-4505.local? What did you request/got for your certificate in the end? Advantages of using the internal DNS zone is it quicker (doesn't have to access the I internet to find DNS records)
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now