Solved

Install amended UCC/SAN SSL certificate on Exchange 2010

Posted on 2010-11-28
14
2,783 Views
Last Modified: 2012-06-22
I have an Exchange 2010 system running off of a single server and I have installed a GoDaddy UCC/SAN SSL certificate with the following domains:

redwoodskills.com
autodiscover.redwoodskills.com.

I have been having issues getting autodiscover/Outlook/handhelds to work correctly and so have decided to add a 3rd domain name into my UCC/SAN SSL certificate.

I have requested an additional SAN (Subject Alternate Name) of webmail.redwoodskills.com be added to the SSL certificate and this has been authorised and the certificate is ready to download and install.

Problem:

The original certificate was purchased using a CSR from the Exchange 2010 server and installed by Completing Pending Request etc...

Has anyone any instructions for how to "update" the existing SSL certificate with the new amended one as GoDaddy's instructions are not very clear on this?

I've seen plenty of noise on the Internet about SSL certificate issues and I'm terrified of breaking what is a semi-working system at present.

Thanks

Brian
0
Comment
Question by:3D2K
  • 8
  • 5
14 Comments
 
LVL 49

Accepted Solution

by:
Akhater earned 250 total points
ID: 34226804
You will need to issue a new CSR and rekey the certificate at GoDaddy
0
 

Author Comment

by:3D2K
ID: 34226893
Akhater

Thanks for the prompt response.

So, I disregard the pending download GoDaddy have offered me?

After that, what happens next?

I have just gone to the Exchange 2010 server to create a new CSR and noticed that it doesn't like my existing certificate:

 SSL Invalid in Exchange 2010
Help...., what does this mean?

This SSL lark is too complicated.

If I create a new CSR as per GoDaddy instructions and rekey my existing SSL certificate what do I do about the existing certificate, and also the Intermediate Certificate Bundle that was originally downloaded and installed?

I'm feeling very, very nervous.

Brian  
0
 

Author Comment

by:3D2K
ID: 34226964
Akhater

I've just tried to create a new CSR on the Exchange 2010 server and it won't allow me to.  It only gives me the option of a wildcard certificate.  Is this because a certificate already exists?

You will notice that there are two certificates on my Exchange 2010 server.  The original self cert and my GoDaddy one.  When I installed the GoDaddy certificate I remember it asking me about transferring services over from an existing certificate and I declined.  Was that wrong?  Should I remove the self cert certificate?

Have you any idea what the current status of the Exchange system is regards OWA and handhelds with the SSL certificates in their current state?

I await your response (eagerly).

Brian
0
NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

 
LVL 30

Expert Comment

by:renazonse
ID: 34226968
It looks like you generated the certificate with the incorrect server name.

Using the Exchange Management Shell type (replacing the server names with your server's names):

FIRST ENTER THIS:

$Data = New-ExchangeCertificate -GenerateRequest -DomainName mail.company.com, autodiscover.company.com, RES-EXS, RES-EXS.company.local -Friendlyname mail.company.com -PrivateKeyExportable:$true

NEXT ENTER THIS:

Set-Content -path "C:\certificate_request.txt" -Value $Data

Then, your correct certificate request will be at "C:\certificate_request.txt" and you can use this to generate your certificate at GoDaddy...as long as your Friendly name is the same on the first cert you generated you'll be good to go... GoDaddy's certification authority has pretty good support and you can actually talk to a person that will help you out on the phone if you need.

Once you have the downloaded certificate you can import it in the Exchange Management Shell like so (again replacing the cert name with your cert's name):

Import-ExchangeCertificate -FileData ([Byte[]]$(Get-Content -Path c:\mail.company.com.crt -Encoding byte -ReadCount 0)) | Enable-ExchangeCertificate –Services “POP, IMAP, IIS, SMTP” -DoNotRequireSSL

Remove the -DoNotRequireSSL if you do want to require SSL.

The intermediate certificate bundle is the same no matter what so you don't need to worry about that being installed...no reason to get nervous here either. Just make sure you use the correct name of the server "RES-EXS"
0
 

Author Comment

by:3D2K
ID: 34226983
Akhater

I've just test OWA and that still works and I've sent a test email to my own account from a Blackberry running email from the Exchange 2010 server and that arrived.

I'm interested to know why when it appears that the Exchange 2010 server doesn't like my GoDaddy UCC/SAN SSL certificate.

Brian
0
 
LVL 30

Expert Comment

by:renazonse
ID: 34226984
You'll need to remove the old certificates...using the Exchange Management Shell:

TYPE : Get-ExchangeCertificate > C:\thumbprint.txt

Open C:\thumbprint.txt and copy the certificate thumbprint out of the text file and :

TYPE : Remove-ExchangeCertificate -Thumbprint <use your thumbprint here>

Then, you can import the new, correct, certificate.
0
 

Author Comment

by:3D2K
ID: 34227008
Renazonse

You've uncovered another problem I have here which I will explain.

The internal domain was named redwood.co.uk on installation and the Exchange server is known as RES-EXS.redwood.co.uk.  It's too late to change that now.

That domain name (redwood.co.uk) does not belong the company that owns the server.  They use a domain name redwoodskills.com on the Internet, which is why the GoDaddy SSL certificate references redwoodskills.com.  GoDaddy will not issue a certificate that references redwood.co.uk as it doesn't belong to me or the company I am working on behalf of.  I have autodiscover.redwoodskills.com pointing to the external IP of the company and the firewall passes any SSL traffic through to the Exchange server.  Another complication is that I use 443 for SSL traffic into the Citrix Secure Gateway server and so my Exchange SSL traffic is using 448.  I'm not going to change that unless I have to as a last resort.

I have been having issues getting autodiscover to work correctly both with OWA and handhelds (Blackberry and IPhone) and Outlook internally is now bleating about certificate problems.  I am referencing an article on MSExchange.org on Exchange Autodiscover which appears to offer a correct setup for my environment.  I don't know when the Exchange server decided it didn't like my original GoDaddy certificate but suspect it happened some time after installation.

All I want to do is add another SAN to the certificate and install it on the Exchange server to follow the instructions on MSExchange.org.

I've asked the question of Akhater, but I'll ask you too.  Should I remove the Exchange self cert certificate shown above?

Many Thanks

Brian
0
 
LVL 30

Expert Comment

by:renazonse
ID: 34227053
Wow...I'm not sure you're ever going to get this to work properly without getting your full internal server name added to the cert but I guess you don't have much of an option right now...sounds like you'll just have to leave the RES-EXS.redwood.co.uk out of the generated cert.

It's my understanding that Autodiscover is definitely not going to work on alternate port...read Sembee's remarks in this thread: http://forums.msexchange.org/m_1800487312/mpage_1/key_/tm.htm#1800487335

Remove the complaining and incorrect certificates and continue where you're going.
0
 

Author Comment

by:3D2K
ID: 34227118
Renazonse

I think I am nearly there. I don't have an External URL setup for OWA and other services and the MSExchange.org article seems to fill in the blanks as far as having an internal URL different from an external URL and using split DNS.  I am wanting to use webmail.redwoodskills.com rather than referencing autodiscover.redwoodskills.com so that they are separated.  Hence my request to add webmail.redwoodskills.com to my certificate.

You probably understand that I'm not an expert with this stuff, suppose I should be as I've been at it a long long time, but it really is getting too complicated now...and I'm old :-).

It looks as if I will have to remove the original GoDaddy certificate before I can create another CSR but I'm worried what effect that is going to have on an already creaking system, and how long it takes GoDaddy to issue new certificates.

OWA work fine both externally and internally and Out-of-Office functionality works.
Outlook works internally but Out-of-Office doesn't work.
Handhelds are problematic, some work some don't, bit that's for another time.

I'm also not too clever with the Exchange Shell and would prefer to use the GUI.  Can I remove the existing certificates using the GUI correctly, and should I remove both as shown above?

I've had enough today so I'll pick this back up in the morning.

The end user is 200 miles from me and I don't really want to have to visit them again as this job is already costing me money :-(.

Thanks again

Brian
0
 

Author Comment

by:3D2K
ID: 34227251
The certificate is invalid for Exchange Server usage error appears to be an issue with revocation lists whatever they are, so I'm investigating further.
0
 
LVL 30

Expert Comment

by:renazonse
ID: 34227252
You don't have to remove the existing cert to generate the new one...once the new cert is generated the old one will cease to work and you'll need to install the new one then.

You should be able to right click on the certificates listed in your screenshot to remove them:

http://msexchangegeek.com/2009/05/13/exchange-2010-emc-and-certificates-management-part-1
0
 

Author Comment

by:3D2K
ID: 34231409
Renazonse

I took your advice and called GoDaddy but they were no help.

I appear to be going around in circles.

I think I am going to have to:

1) Remove the original GoDaddy certificate
2) Generate a new CSR
3) Send the CSR to GoDaddy to ReKey the certificate
4) Install the new certificate,

but
 
What adverse effects will I encounter on Removing the original certificate?
What about the Intermediate Certificate Bundle shipped with the original certificate?  Will that need removing/reinstalling with the new certificate?

This is Hell....

Brian
0
 
LVL 30

Assisted Solution

by:renazonse
renazonse earned 250 total points
ID: 34231976
You don't have to remove the certificate until you're ready to install the new one. Once the certificate is rekeyed it will disable the old one and you'll be ready to install at that point.

You don't have to worry about the intermediate certs that come with the certificate from GoDaddy...those are just updated trusted root certs and they never have to be removed and they are identical with every certificate that's issued at GoDaddy.

Your process listed above is the way to go...the certs are usually issued within a couple of hours at GoDaddy so there should be little or no downtime.
0
 

Author Closing Comment

by:3D2K
ID: 34234763
Hi Guys

I've rekeyed the SSL certificate as proposed by Akhater after a running dialogue with Renazonse on the finer points of configuration and installation so I'm sharing the points out.

Brian
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
Find out what you should include to make the best professional email signature for your organization.
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…

803 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question