SSL Certs with no intermediate stuff

[chazzy2501]

Not really delt with Certs much but I thought it'd be nice to offer SSL over OWA ) I need to buy a cert but I'd rather not have the additional pain of using intermediate certs.

 

btw is it worth getting a wildcard cert? or is it a service?

 

Plus if anyone has a nice clear guide on using certs with exchange 2007 that'd be nice to. (I know enough to refresh my Self certs but thats it)

[FN-GM]

for exchange you will need a SAN cert and include the internal name of your Exchange server. If you dont your outlook clients will give your certificate errors. You can use a wildcard and do this with Exchange but i am not sure if it is supported.

[chazzy2501]

Oh? I cant just get a cert for the IIS and leave the rest self cert?

[sukh]

You can, OWA just uses IIS, so you can use a 3rd party cert for simplcity.

[FN-GM]

Erm i have a feeling you cant in exchange @sukh might know

[SYNACK]

You can use a non SAN cert in exchange but you must use split DNS and mess with the autodiscover and other internal URLs to make them all use the same domains internally and externally.

[sukh]

For simplicity, get a 3rd part cert otherwsie end users will get cert prompts. If you do get a 3rd part cert, then you simply assign this to the services you want, i.e IIS, SMTP, IMAP4 etc..

 

Get the name you want in the cert, make sure to get your common name correct and that's just about it.

[qcomer]

I would just do it the proper way and get a UCC/SAN cert. We use GoDaddy for this as they are pretty cheap.

 

This way its the recommended format, it works properly and you dont have to do any special configs.

[Arthur]

I'd rather not have the additional pain of using intermediate certs.

You are going to have to pay a lot more if you don't want an intermediate certificate. I can't see the "pain" being worth the additional cost personally.

 

For a 5 domain 3 year UCC, GoDaddy charge $215.97 (£140.48) whereas DigiCert charge $928 (£603.62). A difference of £463.14!

[qcomer]

What do you mean additional pain of an intermediate cert? You download it, put it in the intermediate store of your exchange server and voila! done.

[grant_girdwood]

We use a wildcard certificate to cover our OWA and other external services we provide.