Exchange 2010 CAS/HUB SSL Proper Configuration

9/9/2010

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.

View this solution by signing up for a free trial.

Members can start a 7-Day free trial and enjoy unlimited access to the platform.

GET A PERSONALIZED SOLUTION

Ask your own question & get feedback from real experts

Find out why thousands trust the EE community with their toughest problems.

sunnyc7

9/9/2010

endital's got it.... I think.

PS: did you buy a UCC/SAN Cert and add the 4 names

mail.domain.com
autodiscover.domain.com
mailservername.domain.local
mailservername

Also - please output the results of jim's cmdlets from above.

jetli87

9/9/2010

ASKER

Hi All,

Yes i did buy a UCC Cert.

Actually i found this link and i'm testing and it seemed to have solved the issue:

http://support.microsoft.com/kb/940726

endital1097

9/9/2010

remember with 2010 your client always connects to the CAS server so this is expected behavior

Your help has saved me hundreds of hours of internet surfing.

fblack61

sunnyc7

9/9/2010

that's what endital was aiming for

Please post back if you face any issues.

sunnyc7

9/9/2010

Still, please post back the output of the cmdlets, so that we can verify if everything is in order.

http:#33642821

jetli87

9/9/2010

ASKER

Below is the output after using the commands in the MS KB to set URLs.

[PS] C:\Windows\system32>Get-ExchangeCertificate | where { $_.Services.ToString().Contains("IIS") -eq $true } | ft Cert*


CertificateDomains                                          CertificateRequest
------------------                                          ------------------
{Email.company.com, www.Email.company...


[PS] C:\Windows\system32>get-webservicesvirtualdirectory | fl *url


InternalNLBBypassUrl : https://email.company.com/ews/exchange.asmx
InternalUrl          : https://email.company.com/ews/exchange.asmx
ExternalUrl          : https://email.company.com/ews/exchange.asmx



[PS] C:\Windows\system32>get-clientaccessSErver | fl *uri


AutoDiscoverServiceInternalUri : https://email.company.com/autodiscover/autodiscover.xml

Find out why thousands trust the EE community with their toughest problems.

SOLUTION

9/9/2010

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.

View this solution by signing up for a free trial.

Members can start a 7-Day free trial and enjoy unlimited access to the platform.

GET A PERSONALIZED SOLUTION

Ask your own question & get feedback from real experts

Find out why thousands trust the EE community with their toughest problems.

sunnyc7

9/9/2010

I hope you have an internal DNS entry for email.company.com > pointing to local IP of your exchange server ?

jetli87

9/9/2010

ASKER

endital,

the return is below

ExternalHostname : outlook.company.com

All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat

jetli87

9/9/2010

ASKER

sunnyc,

yes, internal DNS for email.company.com ==> 192.x.x.7 (CAS/HUB Exchange Server)

External: email.company.com ==> 74.x.x.x ==> 192.x.x.7

William Peck

sunnyc7

9/9/2010

do you have a external dns entry for outlook.company.com ?

You can check this guide.
https://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/A_3585-Exchange-Autodiscover-and-Web-Services-OOF-and-OAB.html

endital1097

9/9/2010

run the following to have it match your cert
set-outlookanywhere -externalhostname email.company.com

you'll may need to update your outlook profile

jetli87

9/9/2010

ASKER

I'm using outlook.company.com for outlookanywhere.

I have external DNS: outlook.company.com ==> 74.x.x.x ==> 192.x.x.7

Find out why thousands trust the EE community with their toughest problems.

sunnyc7

9/9/2010

Thats good @ internal dns

your settings are ok for autodiscover / SCP's and UCC/SAN's

endital1097

9/9/2010

does outlook.company.com appear on the certificate domain names

SOLUTION

9/9/2010

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.

View this solution by signing up for a free trial.

Members can start a 7-Day free trial and enjoy unlimited access to the platform.

Find out why thousands trust the EE community with their toughest problems.

sunnyc7

9/9/2010

If you have external DNS for outlook.company.com - then everything looks ok.

Are you using that for RPC/HTTPS or do you have another DNS for autodiscover.company.com

Time to test

Test for Outlook Anywhere / Autodiscover here
Test it using SSL.

www.testexchangeconnectivity.com/

Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!

James Murphy

jetli87

9/9/2010

ASKER

endital,

yes...my UCC Cert has:

email.company.com
outlook.company.com
autodiscover.company.com

sunnyc7

9/9/2010

I think you have got it covered, only missing piece was the SCP.

Please run the tests and let us know the result. It should pass for both.
Use a non administrator account for tests.

jetli87

9/9/2010

ASKER

thanks...I used the test and everything worked well accept for outlook anywhere.

Find out why thousands trust the EE community with their toughest problems.

sunnyc7

9/9/2010

can you copy paste the error for RPC/HTTPS (OLK anywhere)

endital1097

9/9/2010

i believe you need to run
set-outlookprovider EXPR -CertPrincipalName outlook.company.com

sunnyc7

9/9/2010

yep

I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst

William Peck

jetli87

9/9/2010

ASKER

Command set and re-ran test.

It failed on the last step per below.

SSL mutual authentication with the RPC proxy server is being tested. 
  Verification of mutual authentication failed.

jetli87

9/9/2010

ASKER

here's the error message

note: per MS article, on the second run i did command as such:

set-outlookprovider EXPR -CerPrincipalName "msstd:outlook.company.com"

error below:

 Additional Details 
  The mutual authentication string was not in the expected format. The string provided was outlook.starpointproperties.com.

endital1097

9/9/2010

set-outlookprovider EXPR -CerPrincipalName outlook.company.com -server $null

Find out why thousands trust the EE community with their toughest problems.

sunnyc7

9/9/2010

set-outlookprovider EXPR -CertPrincipalName outlook.company.com -server $null

--

jetli87

9/9/2010

ASKER

tried that command but got this:

WARNING: The command completed successfully but no settings of 'EXPR' have been modified.

endital1097

9/9/2010

i think we have this backwards
outlook anywhere is configured with outlook.company.com but the cert name is email.company.com

set-outlookprovider EXPR -CertPrincipalName email.company.com -server $null

Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!

Walt Forbes

jetli87

9/9/2010

ASKER

and re-did test and same failure on the last step about authentication string in wrong format.

endital1097

9/9/2010

i should say subject name for the cert is email.company.com

sunnyc7

9/9/2010

I think the UCC has these 3 from the post here
email.company.com
outlook.company.com
autodiscover.company.com

http:#33642998

Find out why thousands trust the EE community with their toughest problems.

jetli87

9/9/2010

ASKER

hmmm tried that and and did test, but it's still showing error for outlook.company.com, not email.company.com

and btw, I have cert setup for both names.

jetli87

9/9/2010

ASKER

do i need to restart a service to refresh the settings?

endital1097

9/9/2010

what do you have for authentication methods for outlook anywhere
get-outlookanywhere | iis*

This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.

rwheeler23

SOLUTION

sunnyc7

9/9/2010

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.

View this solution by signing up for a free trial.

Members can start a 7-Day free trial and enjoy unlimited access to the platform.

Find out why thousands trust the EE community with their toughest problems.

jetli87

9/9/2010

ASKER

IISAuthenticationMethods : {Basic}

SOLUTION

sunnyc7

9/9/2010

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.

View this solution by signing up for a free trial.

Members can start a 7-Day free trial and enjoy unlimited access to the platform.

Find out why thousands trust the EE community with their toughest problems.

endital1097

9/9/2010

i thought you were calling it a night :)

SOLUTION

9/9/2010

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.

View this solution by signing up for a free trial.

Members can start a 7-Day free trial and enjoy unlimited access to the platform.

Find out why thousands trust the EE community with their toughest problems.

jetli87

9/9/2010

ASKER

running manual testing:

note on first test it mention email.company.com not matching so i re-ran the below command:

set-outlookprovider EXPR -CertPrincipalName:"msstd:email.company.com" -server $null

and test completed successfully.

So what do i need to change?

Find out why thousands trust the EE community with their toughest problems.

endital1097

9/9/2010

the iisauthentication methods

you can also remove the outlook provider settings from earlier

jetli87

9/9/2010

ASKER

tried

set-OutlookAnywhere -IISAuthenticationMethods Basic,Ntlm

but requested for identity which i assume is the server

so i re-ran

set-OutlookAnywhere -identity exchgateway.company.local -IISAuthenticationMethods Basic,Ntlm

but got error stating that it could not be found on dc1.company.local

endital1097

9/9/2010

get-outlookanywhere | set-outlookanywhere -IISAuthenticationMethods Basic,Ntlm

Your help has saved me hundreds of hours of internet surfing.

fblack61

jetli87

9/9/2010

ASKER

worked this time and re-run RPC/HTTPS test without manual settings and worked too.

So thanks so much for your help and sunnys, but before i can reward points, can you please clarify the below so i can have a better understanding of what I'm doing:

1) When setting up the Exchange services and mapping to SSL Certs, what's the best way to do so? I followed instructions which had me use EMC ==> New Exchange Cert and specificy SSL Names for whichever services i'm using...What's your recommended method to get this done right the first time around?

2) Why use NTLM authentication versus Basic and where do i setup that up the first time around?

endital1097

9/9/2010

1. it depends on your environment, namely dns and what your users use for a url
https://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/A_3585-Exchange-Autodiscover-and-Web-Services-OOF-and-OAB.html

2. you setup NTLM when you enable outlook anywhere. you want to enable both authentication methods for outlook.

you may also want to run
set-outlookprovider expr -certprincipalname $null
you shouldn't need that set with your current cert, and it is best to have this set to null

jetli87

9/10/2010

ASKER

Not trying to close...was trying to assign point for answer...have already requested attention.