Exchange 2007 Certs Problem - "The name on the Certificate is invalid......."

[burgemaster]

We have 2 certs, one purchased from from Geohost ({autodiscover.{school}.sch.uk, webmail.{school}.sch.uk} and a self-signed cert. {mail, mail.{school}.local}

I've just renewed our self-signed SSL certificate as it had expired. I used the command "Get-ExchangeCertificate –Thumbprint “XXXXXXXXXXXXXXXXXXXXX” | New-ExchangeCertificate"

This worked fine.....

 

But now we are getting popups saying "webmail.{school}.sch.uk - The name on the security certificate is invalid or does not match the name of the site" at school and also now when we try and access our OWA (https://webmail.{school}.sch.uk), it appears to be using the self singed cert instead of the GeoHost cert?

 

Ive run through http://support.microsoft.com/kb/940726 and this hasn't changed anything.

 

Here are the results from:

Get-ExchangeCertificate |fl

Get-WebServicesVirtualDirectory | fl

Get-ClientAccessServer | fl

 

Can anyone please advice what I have set incorrectly??

 

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {mail, mail.{school}.local}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : CN=mail
NotAfter           : 15/03/2013 11:03:04
NotBefore          : 15/03/2012 11:03:04
PublicKeySize      : 2048
RootCAType         : None
SerialNumber       : 16C35989EB2BDEB14623F89348ED650D
Services           : IIS, SMTP
Status             : Valid
Subject            : CN=mail
Thumbprint         : 0437788E65A3652B83A7CD25C143A650709E2F73

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {autodiscover.{school}.sch.uk, webmail.{school}.sch.uk}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=GeoTrust SSL CA, O="GeoTrust, Inc.", C=US
NotAfter           : 06/03/2014 08:59:05
NotBefore          : 02/02/2011 06:42:39
PublicKeySize      : 2048
RootCAType         : ThirdParty
SerialNumber       : 60A4
Services           : IMAP, POP, SMTP
Status             : Valid
Subject            : CN=autodiscover.{school}.sch.uk, OU=GT94688674, O={school}, L={town}, S={county}, C=GB, SERIALNUMBER=XXXXXXXXXXXXXX/
Thumbprint         : 9E1B647EAXXXXXXXXXXXBE4546B4478A5CCB




InternalNLBBypassUrl          : [url]https://mail.{school}.local/ews/exchange.asmx[/url]
Name                          : EWS (Default Web Site)
InternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated}
ExternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated}
BasicAuthentication           : True
DigestAuthentication          : False
WindowsAuthentication         : True
MetabasePath                  : IIS://mail.{school}.local/W3SVC/1/ROOT/EWS
Path                          : D:\Program Files\Microsoft\Exchange Server\ClientAccess\exchweb\EWS
Server                        : MAIL
InternalUrl                   : [url]https://mail.{school}.local/ews/exchange.asmx[/url]
ExternalUrl                   : [url]https://webmail.{school}.local/EWS/Exchange.asmx[/url]
AdminDisplayName              : 
ExchangeVersion               : 0.1 (8.0.535.0)
DistinguishedName             : CN=EWS (Default Web Site),CN=HTTP,CN=Protocols,CN=MAIL,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN={school},CN
                               =Microsoft Exchange,CN=Services,CN=Configuration,DC={school},DC=local
Identity                      : MAIL\EWS (Default Web Site)
Guid                          : 3f902766-008a-47d5-9ab1-9b426fa049b1
ObjectCategory                : {school}.local/Configuration/Schema/ms-Exch-Web-Services-Virtual-Directory
ObjectClass                   : {top, msExchVirtualDirectory, msExchWebServicesVirtualDirectory}
WhenChanged                   : 15/03/2012 12:37:09
WhenCreated                   : 31/07/2007 14:46:49
OriginatingServer             : DC1.{school}.local
IsValid                       : True



Name                           : MAIL
OutlookAnywhereEnabled         : True
AutoDiscoverServiceCN          : mail
AutoDiscoverServiceClassName   : ms-Exchange-AutoDiscover-Service
AutoDiscoverServiceInternalUri : [url]https://mail.{school}.local/autodiscover/autodiscover.xml[/url]
AutoDiscoverServiceGuid        : 77378f46-2c66-4aa9-a6a6-3e7a48b19596
AutoDiscoverSiteScope          : {Default-First-Site-Name}
IsValid                        : True
OriginatingServer              : DC1.{school}.local
ExchangeVersion                : 0.1 (8.0.535.0)
DistinguishedName              : CN=MAIL,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN={school},CN=Microsoft Exchange,CN=Services,CN=Configurati
                                on,DC={school},DC=local
Identity                       : MAIL
Guid                           : 83fdfee1-eb98-4942-b34e-e0e103b59757
ObjectCategory                 : {school}.local/Configuration/Schema/ms-Exch-Exchange-Server
ObjectClass                    : {top, server, msExchExchangeServer}
WhenChanged                    : 15/03/2012 11:03:49
WhenCreated                    : 31/07/2007 14:40:33

Edited March 19, 2019 by ZeroHour

[burgemaster]

ok, problem 2 is sorted....

To get OWA/Webmail to use the correct SSL, The correct SSL needs to have IIS enabled on it under services.

 

Enable-ExchangeCertificate – Thumbprint “9E1B647EA0BAD8ACxxxxxxxxxxx6B4478A5CCB” –Services IIS

 

This sets the IIS service to the correct SSL for OWA use, where as it was previously listed on the self cert....

Now just the security popup....

Edited March 15, 2012 by burgemaster

[sukh]

Can you repair the OLK profile and test and create a new one and test.

How many CAS servers do you have?

Have you done an IISREST?

[burgemaster]

It was as simply as an IIS reset!

Thanks