Exchange 2010 SSL certificate advice

[dgsmith]

We're looking to upgrade from exchange 2003 to 2010 and from what I read here and been told, the current single domain certificate we bought will not be functional with 2010.

 

Looking on godaddy, the other 2 options are "multiple domains" and "single domains with unlimited sub domains (wildcard)", both which are showing as being compatible with exch2010 but the latter is quite significantly more expensive.

 

We use https://mail.schooldomain.com to access OWA but I can't work out which of these 2 we'd need. Would the cheaper multiple domains suffice or is there a reason why we'd need to opt for the wildcard one?

[FN-GM]

You need a subject alternative name (SAN) certificate - have a look here Subject Alternative Name | SAN Certificates (UCC Certificate)

[AngryTechnician]

I believe the cheaper cert will suffice. Unless you have a non-standard setup, you only need to cover 2 domain names: the URL used internally by Outlook and internal webmail use, and the external URL you've given above.

[FN-GM]

I believe the cheaper cert will suffice. Unless you have a non-standard setup, you only need to cover 2 domain names: the URL used internally by Outlook and internal webmail use, and the external URL you've given above.

 

Auto discover is another one. IF you dont use a SAN you will get security errors from Outlook. Although you can do some trickery to get it to work with a standard certificate but this isnt supported my MS

[glennda]

When you run the CSR generator it will tell you everything you require.

 

I use the multiple domain UCC from godaddy - SSL Certificates | Secure Your Data & Transactions - Go Daddy

[chazzy2501]

I have exchange 2007. Can I not get a standard SSL cert for just IIS thus OWA? Using only the external URL? (this is all I use internal DNS points to local ip anyway)

[KK20]

for our exchange 2010 we use or internal and external name plus autodiscover. We choose to use a different OWA address.

 

if you dont care about autodiscover then you might be able to get away with mail.DOMAIN and use DNS workarounds internally. We use "certificates for exchange" SAN cert.