Solved

Install amended UCC/SAN SSL certificate on Exchange 2010

Posted on 2010-11-28
14
2,792 Views
Last Modified: 2012-06-22
I have an Exchange 2010 system running off of a single server and I have installed a GoDaddy UCC/SAN SSL certificate with the following domains:

redwoodskills.com
autodiscover.redwoodskills.com.

I have been having issues getting autodiscover/Outlook/handhelds to work correctly and so have decided to add a 3rd domain name into my UCC/SAN SSL certificate.

I have requested an additional SAN (Subject Alternate Name) of webmail.redwoodskills.com be added to the SSL certificate and this has been authorised and the certificate is ready to download and install.

Problem:

The original certificate was purchased using a CSR from the Exchange 2010 server and installed by Completing Pending Request etc...

Has anyone any instructions for how to "update" the existing SSL certificate with the new amended one as GoDaddy's instructions are not very clear on this?

I've seen plenty of noise on the Internet about SSL certificate issues and I'm terrified of breaking what is a semi-working system at present.

Thanks

Brian
0
Comment
Question by:3D2K
  • 8
  • 5
14 Comments
 
LVL 49

Accepted Solution

by:
Akhater earned 250 total points
ID: 34226804
You will need to issue a new CSR and rekey the certificate at GoDaddy
0
 

Author Comment

by:3D2K
ID: 34226893
Akhater

Thanks for the prompt response.

So, I disregard the pending download GoDaddy have offered me?

After that, what happens next?

I have just gone to the Exchange 2010 server to create a new CSR and noticed that it doesn't like my existing certificate:

 SSL Invalid in Exchange 2010
Help...., what does this mean?

This SSL lark is too complicated.

If I create a new CSR as per GoDaddy instructions and rekey my existing SSL certificate what do I do about the existing certificate, and also the Intermediate Certificate Bundle that was originally downloaded and installed?

I'm feeling very, very nervous.

Brian  
0
 

Author Comment

by:3D2K
ID: 34226964
Akhater

I've just tried to create a new CSR on the Exchange 2010 server and it won't allow me to.  It only gives me the option of a wildcard certificate.  Is this because a certificate already exists?

You will notice that there are two certificates on my Exchange 2010 server.  The original self cert and my GoDaddy one.  When I installed the GoDaddy certificate I remember it asking me about transferring services over from an existing certificate and I declined.  Was that wrong?  Should I remove the self cert certificate?

Have you any idea what the current status of the Exchange system is regards OWA and handhelds with the SSL certificates in their current state?

I await your response (eagerly).

Brian
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 
LVL 30

Expert Comment

by:Britt Thompson
ID: 34226968
It looks like you generated the certificate with the incorrect server name.

Using the Exchange Management Shell type (replacing the server names with your server's names):

FIRST ENTER THIS:

$Data = New-ExchangeCertificate -GenerateRequest -DomainName mail.company.com, autodiscover.company.com, RES-EXS, RES-EXS.company.local -Friendlyname mail.company.com -PrivateKeyExportable:$true

NEXT ENTER THIS:

Set-Content -path "C:\certificate_request.txt" -Value $Data

Then, your correct certificate request will be at "C:\certificate_request.txt" and you can use this to generate your certificate at GoDaddy...as long as your Friendly name is the same on the first cert you generated you'll be good to go... GoDaddy's certification authority has pretty good support and you can actually talk to a person that will help you out on the phone if you need.

Once you have the downloaded certificate you can import it in the Exchange Management Shell like so (again replacing the cert name with your cert's name):

Import-ExchangeCertificate -FileData ([Byte[]]$(Get-Content -Path c:\mail.company.com.crt -Encoding byte -ReadCount 0)) | Enable-ExchangeCertificate –Services “POP, IMAP, IIS, SMTP” -DoNotRequireSSL

Remove the -DoNotRequireSSL if you do want to require SSL.

The intermediate certificate bundle is the same no matter what so you don't need to worry about that being installed...no reason to get nervous here either. Just make sure you use the correct name of the server "RES-EXS"
0
 

Author Comment

by:3D2K
ID: 34226983
Akhater

I've just test OWA and that still works and I've sent a test email to my own account from a Blackberry running email from the Exchange 2010 server and that arrived.

I'm interested to know why when it appears that the Exchange 2010 server doesn't like my GoDaddy UCC/SAN SSL certificate.

Brian
0
 
LVL 30

Expert Comment

by:Britt Thompson
ID: 34226984
You'll need to remove the old certificates...using the Exchange Management Shell:

TYPE : Get-ExchangeCertificate > C:\thumbprint.txt

Open C:\thumbprint.txt and copy the certificate thumbprint out of the text file and :

TYPE : Remove-ExchangeCertificate -Thumbprint <use your thumbprint here>

Then, you can import the new, correct, certificate.
0
 

Author Comment

by:3D2K
ID: 34227008
Renazonse

You've uncovered another problem I have here which I will explain.

The internal domain was named redwood.co.uk on installation and the Exchange server is known as RES-EXS.redwood.co.uk.  It's too late to change that now.

That domain name (redwood.co.uk) does not belong the company that owns the server.  They use a domain name redwoodskills.com on the Internet, which is why the GoDaddy SSL certificate references redwoodskills.com.  GoDaddy will not issue a certificate that references redwood.co.uk as it doesn't belong to me or the company I am working on behalf of.  I have autodiscover.redwoodskills.com pointing to the external IP of the company and the firewall passes any SSL traffic through to the Exchange server.  Another complication is that I use 443 for SSL traffic into the Citrix Secure Gateway server and so my Exchange SSL traffic is using 448.  I'm not going to change that unless I have to as a last resort.

I have been having issues getting autodiscover to work correctly both with OWA and handhelds (Blackberry and IPhone) and Outlook internally is now bleating about certificate problems.  I am referencing an article on MSExchange.org on Exchange Autodiscover which appears to offer a correct setup for my environment.  I don't know when the Exchange server decided it didn't like my original GoDaddy certificate but suspect it happened some time after installation.

All I want to do is add another SAN to the certificate and install it on the Exchange server to follow the instructions on MSExchange.org.

I've asked the question of Akhater, but I'll ask you too.  Should I remove the Exchange self cert certificate shown above?

Many Thanks

Brian
0
 
LVL 30

Expert Comment

by:Britt Thompson
ID: 34227053
Wow...I'm not sure you're ever going to get this to work properly without getting your full internal server name added to the cert but I guess you don't have much of an option right now...sounds like you'll just have to leave the RES-EXS.redwood.co.uk out of the generated cert.

It's my understanding that Autodiscover is definitely not going to work on alternate port...read Sembee's remarks in this thread: http://forums.msexchange.org/m_1800487312/mpage_1/key_/tm.htm#1800487335

Remove the complaining and incorrect certificates and continue where you're going.
0
 

Author Comment

by:3D2K
ID: 34227118
Renazonse

I think I am nearly there. I don't have an External URL setup for OWA and other services and the MSExchange.org article seems to fill in the blanks as far as having an internal URL different from an external URL and using split DNS.  I am wanting to use webmail.redwoodskills.com rather than referencing autodiscover.redwoodskills.com so that they are separated.  Hence my request to add webmail.redwoodskills.com to my certificate.

You probably understand that I'm not an expert with this stuff, suppose I should be as I've been at it a long long time, but it really is getting too complicated now...and I'm old :-).

It looks as if I will have to remove the original GoDaddy certificate before I can create another CSR but I'm worried what effect that is going to have on an already creaking system, and how long it takes GoDaddy to issue new certificates.

OWA work fine both externally and internally and Out-of-Office functionality works.
Outlook works internally but Out-of-Office doesn't work.
Handhelds are problematic, some work some don't, bit that's for another time.

I'm also not too clever with the Exchange Shell and would prefer to use the GUI.  Can I remove the existing certificates using the GUI correctly, and should I remove both as shown above?

I've had enough today so I'll pick this back up in the morning.

The end user is 200 miles from me and I don't really want to have to visit them again as this job is already costing me money :-(.

Thanks again

Brian
0
 

Author Comment

by:3D2K
ID: 34227251
The certificate is invalid for Exchange Server usage error appears to be an issue with revocation lists whatever they are, so I'm investigating further.
0
 
LVL 30

Expert Comment

by:Britt Thompson
ID: 34227252
You don't have to remove the existing cert to generate the new one...once the new cert is generated the old one will cease to work and you'll need to install the new one then.

You should be able to right click on the certificates listed in your screenshot to remove them:

http://msexchangegeek.com/2009/05/13/exchange-2010-emc-and-certificates-management-part-1
0
 

Author Comment

by:3D2K
ID: 34231409
Renazonse

I took your advice and called GoDaddy but they were no help.

I appear to be going around in circles.

I think I am going to have to:

1) Remove the original GoDaddy certificate
2) Generate a new CSR
3) Send the CSR to GoDaddy to ReKey the certificate
4) Install the new certificate,

but
 
What adverse effects will I encounter on Removing the original certificate?
What about the Intermediate Certificate Bundle shipped with the original certificate?  Will that need removing/reinstalling with the new certificate?

This is Hell....

Brian
0
 
LVL 30

Assisted Solution

by:Britt Thompson
Britt Thompson earned 250 total points
ID: 34231976
You don't have to remove the certificate until you're ready to install the new one. Once the certificate is rekeyed it will disable the old one and you'll be ready to install at that point.

You don't have to worry about the intermediate certs that come with the certificate from GoDaddy...those are just updated trusted root certs and they never have to be removed and they are identical with every certificate that's issued at GoDaddy.

Your process listed above is the way to go...the certs are usually issued within a couple of hours at GoDaddy so there should be little or no downtime.
0
 

Author Closing Comment

by:3D2K
ID: 34234763
Hi Guys

I've rekeyed the SSL certificate as proposed by Akhater after a running dialogue with Renazonse on the finer points of configuration and installation so I'm sharing the points out.

Brian
0

Featured Post

Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
Utilizing an array to gracefully append to a list of EmailAddresses
In this video we show how to create an Accepted Domain in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Ac…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question