Exchange 2007 certificate error - intermediate

On an Exchange 2007 server, when we try to connect via IMAP, it is giving an error that the certificate is invalid.  We do have a Verisign certificate for owa which is attached to service https (obviously), but when I do an Get-ExchangeCertificate |fl  it show the intermediate cert on services IMAP, POP, SMTP with a status of 'invalid'.  See below ...
[PS] C:\Windows\System32>Get-ExchangeCertificate |fl


AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {ex1.pittstonarea.com}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=VeriSign Class 3 Secure Server CA - G2, OU=Terms of use
                      at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust
                     Network, O="VeriSign, Inc.", C=US
NotAfter           : 2/9/2011 6:59:59 PM
NotBefore          : 2/8/2010 7:00:00 PM
PublicKeySize      : 1024
RootCAType         : ThirdParty
SerialNumber       : 067CCBC2A2ED1C8634248D9D22918B07
Services           : IIS
Status             : Valid
Subject            : CN=ex1.pittstonarea.com, OU=Terms of use at www.verisign.c
                     om/rpa (c)05, OU=IT, O=Pittston Area School District, L=Pi
                     ttston, S=Pennsylvania, C=US
Thumbprint         : 1C45B6E89689608E93C9F86983DE1B6AD75E440C

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {ex1, ex1.pittstonarea.com}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : CN=ex1
NotAfter           : 8/28/2010 3:14:38 PM
NotBefore          : 8/28/2009 3:14:38 PM
PublicKeySize      : 2048
RootCAType         : Unknown
SerialNumber       : 7469585F30ACC7B049042C469689DEF9
Services           : IMAP, POP, SMTP
Status             : Invalid
Subject            : CN=ex1
Thumbprint         : 94310AD540EB390EFC41320DFD6858ADE8AC64CE


How can I either get my verisign cert to include the other 3 services, or remove and create a new intermediate cert for the 3 services without breaking the Verisign cert?

Thanks
dmfcviAsked:
Who is Participating?
 
Narayan_singhConnect With a Mentor Commented:
you can use the same certificate for IMAP that is used for IIS do this
enable-exchangecertificate -thumbprint 1C45B6E89689608E93C9F86983DE1B6AD75E440C -services IMAP

thumbprint is the one which is valid

you might wanna restart the services after enabling the certificate
0
 
e_aravindCommented:
Some time,
we need to install the intermediate Certificate on the server's CAPI store (mmc > certmgr computer)
0
 
ParanormasticConnect With a Mentor Cryptographic EngineerCommented:
These were both touched on above, but here's a little more detail:

That's not an intermediate cert - its a root cert - it is self-signed (issuer and subject are the same).  You can import that to your trusted root store:
certutil -addstore root 94310AD540EB390EFC41320DFD6858ADE8AC64CE

to use your verisign cert:
enable-exchangecertificate -thumbprint 1C45B6E89689608E93C9F86983DE1B6AD75E440C -services "SMTP, IMAP, POP, IIS, UM"

Not sure which of the above "services" you are looking for, but those are the choices - remove what you don't want.
0
 
dmfcviAuthor Commented:
I chose to do the enable-exchangecertificate option ... question - now when I run Get-ExchangeCertificate |fl    both certs show IMAP as a service.  I assume that doesnt matter, but what if we wanted to remove it from the root cert ...
0
 
ParanormasticCryptographic EngineerCommented:
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.