Install amended UCC/SAN SSL certificate on Exchange 2010

Akhater

Thanks for the prompt response.

So, I disregard the pending download GoDaddy have offered me?

After that, what happens next?

I have just gone to the Exchange 2010 server to create a new CSR and noticed that it doesn't like my existing certificate:

 
Help...., what does this mean?

This SSL lark is too complicated.

If I create a new CSR as per GoDaddy instructions and rekey my existing SSL certificate what do I do about the existing certificate, and also the Intermediate Certificate Bundle that was originally downloaded and installed?

I'm feeling very, very nervous.

Brian  

Akhater

I've just tried to create a new CSR on the Exchange 2010 server and it won't allow me to.  It only gives me the option of a wildcard certificate.  Is this because a certificate already exists?

You will notice that there are two certificates on my Exchange 2010 server.  The original self cert and my GoDaddy one.  When I installed the GoDaddy certificate I remember it asking me about transferring services over from an existing certificate and I declined.  Was that wrong?  Should I remove the self cert certificate?

Have you any idea what the current status of the Exchange system is regards OWA and handhelds with the SSL certificates in their current state?

I await your response (eagerly).

Brian

It looks like you generated the certificate with the incorrect server name.

Using the Exchange Management Shell type (replacing the server names with your server's names):

FIRST ENTER THIS:

$Data = New-ExchangeCertificate -GenerateRequest -DomainName mail.company.com, autodiscover.company.com, RES-EXS, RES-EXS.company.local -Friendlyname mail.company.com -PrivateKeyExportable:$true

NEXT ENTER THIS:

Set-Content -path "C:\certificate_request.txt" -Value $Data

Then, your correct certificate request will be at "C:\certificate_request.txt" and you can use this to generate your certificate at GoDaddy...as long as your Friendly name is the same on the first cert you generated you'll be good to go... GoDaddy's certification authority has pretty good support and you can actually talk to a person that will help you out on the phone if you need.

Once you have the downloaded certificate you can import it in the Exchange Management Shell like so (again replacing the cert name with your cert's name):

Import-ExchangeCertificate -FileData ([Byte[]]$(Get-Content -Path c:\mail.company.com.crt -Encoding byte -ReadCount 0)) | Enable-ExchangeCertificate –Services “POP, IMAP, IIS, SMTP” -DoNotRequireSSL

Remove the -DoNotRequireSSL if you do want to require SSL.

The intermediate certificate bundle is the same no matter what so you don't need to worry about that being installed...no reason to get nervous here either. Just make sure you use the correct name of the server "RES-EXS"

Akhater

I've just test OWA and that still works and I've sent a test email to my own account from a Blackberry running email from the Exchange 2010 server and that arrived.

I'm interested to know why when it appears that the Exchange 2010 server doesn't like my GoDaddy UCC/SAN SSL certificate.

Brian

You'll need to remove the old certificates...using the Exchange Management Shell:

TYPE : Get-ExchangeCertificate > C:\thumbprint.txt

Open C:\thumbprint.txt and copy the certificate thumbprint out of the text file and :

TYPE : Remove-ExchangeCertificate -Thumbprint <use your thumbprint here>

Then, you can import the new, correct, certificate.

Renazonse

You've uncovered another problem I have here which I will explain.

The internal domain was named redwood.co.uk on installation and the Exchange server is known as RES-EXS.redwood.co.uk.  It's too late to change that now.

That domain name (redwood.co.uk) does not belong the company that owns the server.  They use a domain name redwoodskills.com on the Internet, which is why the GoDaddy SSL certificate references redwoodskills.com.  GoDaddy will not issue a certificate that references redwood.co.uk as it doesn't belong to me or the company I am working on behalf of.  I have autodiscover.redwoodskills.com pointing to the external IP of the company and the firewall passes any SSL traffic through to the Exchange server.  Another complication is that I use 443 for SSL traffic into the Citrix Secure Gateway server and so my Exchange SSL traffic is using 448.  I'm not going to change that unless I have to as a last resort.

I have been having issues getting autodiscover to work correctly both with OWA and handhelds (Blackberry and IPhone) and Outlook internally is now bleating about certificate problems.  I am referencing an article on MSExchange.org on Exchange Autodiscover which appears to offer a correct setup for my environment.  I don't know when the Exchange server decided it didn't like my original GoDaddy certificate but suspect it happened some time after installation.

All I want to do is add another SAN to the certificate and install it on the Exchange server to follow the instructions on MSExchange.org.

I've asked the question of Akhater, but I'll ask you too.  Should I remove the Exchange self cert certificate shown above?

Many Thanks

Brian

Wow...I'm not sure you're ever going to get this to work properly without getting your full internal server name added to the cert but I guess you don't have much of an option right now...sounds like you'll just have to leave the RES-EXS.redwood.co.uk out of the generated cert.

It's my understanding that Autodiscover is definitely not going to work on alternate port...read Sembee's remarks in this thread: http://forums.msexchange.org/m_1800487312/mpage_1/key_/tm.htm#1800487335

Remove the complaining and incorrect certificates and continue where you're going.

Renazonse

I think I am nearly there. I don't have an External URL setup for OWA and other services and the MSExchange.org article seems to fill in the blanks as far as having an internal URL different from an external URL and using split DNS.  I am wanting to use webmail.redwoodskills.com rather than referencing autodiscover.redwoodskills.com so that they are separated.  Hence my request to add webmail.redwoodskills.com to my certificate.

You probably understand that I'm not an expert with this stuff, suppose I should be as I've been at it a long long time, but it really is getting too complicated now...and I'm old :-).

It looks as if I will have to remove the original GoDaddy certificate before I can create another CSR but I'm worried what effect that is going to have on an already creaking system, and how long it takes GoDaddy to issue new certificates.

OWA work fine both externally and internally and Out-of-Office functionality works.
Outlook works internally but Out-of-Office doesn't work.
Handhelds are problematic, some work some don't, bit that's for another time.

I'm also not too clever with the Exchange Shell and would prefer to use the GUI.  Can I remove the existing certificates using the GUI correctly, and should I remove both as shown above?

I've had enough today so I'll pick this back up in the morning.

The end user is 200 miles from me and I don't really want to have to visit them again as this job is already costing me money :-(.

Thanks again

Brian

The certificate is invalid for Exchange Server usage error appears to be an issue with revocation lists whatever they are, so I'm investigating further.

You don't have to remove the existing cert to generate the new one...once the new cert is generated the old one will cease to work and you'll need to install the new one then.

You should be able to right click on the certificates listed in your screenshot to remove them:

http://msexchangegeek.com/2009/05/13/exchange-2010-emc-and-certificates-management-part-1

Renazonse

I took your advice and called GoDaddy but they were no help.

I appear to be going around in circles.

I think I am going to have to:

1) Remove the original GoDaddy certificate
2) Generate a new CSR
3) Send the CSR to GoDaddy to ReKey the certificate
4) Install the new certificate,

but
 
What adverse effects will I encounter on Removing the original certificate?
What about the Intermediate Certificate Bundle shipped with the original certificate?  Will that need removing/reinstalling with the new certificate?

This is Hell....

Brian

Hi Guys

I've rekeyed the SSL certificate as proposed by Akhater after a running dialogue with Renazonse on the finer points of configuration and installation so I'm sharing the points out.

Brian