Solved

Install amended UCC/SAN SSL certificate on Exchange 2010

Posted on 2010-11-28
14
2,759 Views
Last Modified: 2012-06-22
I have an Exchange 2010 system running off of a single server and I have installed a GoDaddy UCC/SAN SSL certificate with the following domains:

redwoodskills.com
autodiscover.redwoodskills.com.

I have been having issues getting autodiscover/Outlook/handhelds to work correctly and so have decided to add a 3rd domain name into my UCC/SAN SSL certificate.

I have requested an additional SAN (Subject Alternate Name) of webmail.redwoodskills.com be added to the SSL certificate and this has been authorised and the certificate is ready to download and install.

Problem:

The original certificate was purchased using a CSR from the Exchange 2010 server and installed by Completing Pending Request etc...

Has anyone any instructions for how to "update" the existing SSL certificate with the new amended one as GoDaddy's instructions are not very clear on this?

I've seen plenty of noise on the Internet about SSL certificate issues and I'm terrified of breaking what is a semi-working system at present.

Thanks

Brian
0
Comment
Question by:3D2K
  • 8
  • 5
14 Comments
 
LVL 49

Accepted Solution

by:
Akhater earned 250 total points
Comment Utility
You will need to issue a new CSR and rekey the certificate at GoDaddy
0
 

Author Comment

by:3D2K
Comment Utility
Akhater

Thanks for the prompt response.

So, I disregard the pending download GoDaddy have offered me?

After that, what happens next?

I have just gone to the Exchange 2010 server to create a new CSR and noticed that it doesn't like my existing certificate:

 SSL Invalid in Exchange 2010
Help...., what does this mean?

This SSL lark is too complicated.

If I create a new CSR as per GoDaddy instructions and rekey my existing SSL certificate what do I do about the existing certificate, and also the Intermediate Certificate Bundle that was originally downloaded and installed?

I'm feeling very, very nervous.

Brian  
0
 

Author Comment

by:3D2K
Comment Utility
Akhater

I've just tried to create a new CSR on the Exchange 2010 server and it won't allow me to.  It only gives me the option of a wildcard certificate.  Is this because a certificate already exists?

You will notice that there are two certificates on my Exchange 2010 server.  The original self cert and my GoDaddy one.  When I installed the GoDaddy certificate I remember it asking me about transferring services over from an existing certificate and I declined.  Was that wrong?  Should I remove the self cert certificate?

Have you any idea what the current status of the Exchange system is regards OWA and handhelds with the SSL certificates in their current state?

I await your response (eagerly).

Brian
0
 
LVL 30

Expert Comment

by:renazonse
Comment Utility
It looks like you generated the certificate with the incorrect server name.

Using the Exchange Management Shell type (replacing the server names with your server's names):

FIRST ENTER THIS:

$Data = New-ExchangeCertificate -GenerateRequest -DomainName mail.company.com, autodiscover.company.com, RES-EXS, RES-EXS.company.local -Friendlyname mail.company.com -PrivateKeyExportable:$true

NEXT ENTER THIS:

Set-Content -path "C:\certificate_request.txt" -Value $Data

Then, your correct certificate request will be at "C:\certificate_request.txt" and you can use this to generate your certificate at GoDaddy...as long as your Friendly name is the same on the first cert you generated you'll be good to go... GoDaddy's certification authority has pretty good support and you can actually talk to a person that will help you out on the phone if you need.

Once you have the downloaded certificate you can import it in the Exchange Management Shell like so (again replacing the cert name with your cert's name):

Import-ExchangeCertificate -FileData ([Byte[]]$(Get-Content -Path c:\mail.company.com.crt -Encoding byte -ReadCount 0)) | Enable-ExchangeCertificate –Services “POP, IMAP, IIS, SMTP” -DoNotRequireSSL

Remove the -DoNotRequireSSL if you do want to require SSL.

The intermediate certificate bundle is the same no matter what so you don't need to worry about that being installed...no reason to get nervous here either. Just make sure you use the correct name of the server "RES-EXS"
0
 

Author Comment

by:3D2K
Comment Utility
Akhater

I've just test OWA and that still works and I've sent a test email to my own account from a Blackberry running email from the Exchange 2010 server and that arrived.

I'm interested to know why when it appears that the Exchange 2010 server doesn't like my GoDaddy UCC/SAN SSL certificate.

Brian
0
 
LVL 30

Expert Comment

by:renazonse
Comment Utility
You'll need to remove the old certificates...using the Exchange Management Shell:

TYPE : Get-ExchangeCertificate > C:\thumbprint.txt

Open C:\thumbprint.txt and copy the certificate thumbprint out of the text file and :

TYPE : Remove-ExchangeCertificate -Thumbprint <use your thumbprint here>

Then, you can import the new, correct, certificate.
0
 

Author Comment

by:3D2K
Comment Utility
Renazonse

You've uncovered another problem I have here which I will explain.

The internal domain was named redwood.co.uk on installation and the Exchange server is known as RES-EXS.redwood.co.uk.  It's too late to change that now.

That domain name (redwood.co.uk) does not belong the company that owns the server.  They use a domain name redwoodskills.com on the Internet, which is why the GoDaddy SSL certificate references redwoodskills.com.  GoDaddy will not issue a certificate that references redwood.co.uk as it doesn't belong to me or the company I am working on behalf of.  I have autodiscover.redwoodskills.com pointing to the external IP of the company and the firewall passes any SSL traffic through to the Exchange server.  Another complication is that I use 443 for SSL traffic into the Citrix Secure Gateway server and so my Exchange SSL traffic is using 448.  I'm not going to change that unless I have to as a last resort.

I have been having issues getting autodiscover to work correctly both with OWA and handhelds (Blackberry and IPhone) and Outlook internally is now bleating about certificate problems.  I am referencing an article on MSExchange.org on Exchange Autodiscover which appears to offer a correct setup for my environment.  I don't know when the Exchange server decided it didn't like my original GoDaddy certificate but suspect it happened some time after installation.

All I want to do is add another SAN to the certificate and install it on the Exchange server to follow the instructions on MSExchange.org.

I've asked the question of Akhater, but I'll ask you too.  Should I remove the Exchange self cert certificate shown above?

Many Thanks

Brian
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 30

Expert Comment

by:renazonse
Comment Utility
Wow...I'm not sure you're ever going to get this to work properly without getting your full internal server name added to the cert but I guess you don't have much of an option right now...sounds like you'll just have to leave the RES-EXS.redwood.co.uk out of the generated cert.

It's my understanding that Autodiscover is definitely not going to work on alternate port...read Sembee's remarks in this thread: http://forums.msexchange.org/m_1800487312/mpage_1/key_/tm.htm#1800487335

Remove the complaining and incorrect certificates and continue where you're going.
0
 

Author Comment

by:3D2K
Comment Utility
Renazonse

I think I am nearly there. I don't have an External URL setup for OWA and other services and the MSExchange.org article seems to fill in the blanks as far as having an internal URL different from an external URL and using split DNS.  I am wanting to use webmail.redwoodskills.com rather than referencing autodiscover.redwoodskills.com so that they are separated.  Hence my request to add webmail.redwoodskills.com to my certificate.

You probably understand that I'm not an expert with this stuff, suppose I should be as I've been at it a long long time, but it really is getting too complicated now...and I'm old :-).

It looks as if I will have to remove the original GoDaddy certificate before I can create another CSR but I'm worried what effect that is going to have on an already creaking system, and how long it takes GoDaddy to issue new certificates.

OWA work fine both externally and internally and Out-of-Office functionality works.
Outlook works internally but Out-of-Office doesn't work.
Handhelds are problematic, some work some don't, bit that's for another time.

I'm also not too clever with the Exchange Shell and would prefer to use the GUI.  Can I remove the existing certificates using the GUI correctly, and should I remove both as shown above?

I've had enough today so I'll pick this back up in the morning.

The end user is 200 miles from me and I don't really want to have to visit them again as this job is already costing me money :-(.

Thanks again

Brian
0
 

Author Comment

by:3D2K
Comment Utility
The certificate is invalid for Exchange Server usage error appears to be an issue with revocation lists whatever they are, so I'm investigating further.
0
 
LVL 30

Expert Comment

by:renazonse
Comment Utility
You don't have to remove the existing cert to generate the new one...once the new cert is generated the old one will cease to work and you'll need to install the new one then.

You should be able to right click on the certificates listed in your screenshot to remove them:

http://msexchangegeek.com/2009/05/13/exchange-2010-emc-and-certificates-management-part-1
0
 

Author Comment

by:3D2K
Comment Utility
Renazonse

I took your advice and called GoDaddy but they were no help.

I appear to be going around in circles.

I think I am going to have to:

1) Remove the original GoDaddy certificate
2) Generate a new CSR
3) Send the CSR to GoDaddy to ReKey the certificate
4) Install the new certificate,

but
 
What adverse effects will I encounter on Removing the original certificate?
What about the Intermediate Certificate Bundle shipped with the original certificate?  Will that need removing/reinstalling with the new certificate?

This is Hell....

Brian
0
 
LVL 30

Assisted Solution

by:renazonse
renazonse earned 250 total points
Comment Utility
You don't have to remove the certificate until you're ready to install the new one. Once the certificate is rekeyed it will disable the old one and you'll be ready to install at that point.

You don't have to worry about the intermediate certs that come with the certificate from GoDaddy...those are just updated trusted root certs and they never have to be removed and they are identical with every certificate that's issued at GoDaddy.

Your process listed above is the way to go...the certs are usually issued within a couple of hours at GoDaddy so there should be little or no downtime.
0
 

Author Closing Comment

by:3D2K
Comment Utility
Hi Guys

I've rekeyed the SSL certificate as proposed by Akhater after a running dialogue with Renazonse on the finer points of configuration and installation so I'm sharing the points out.

Brian
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Resolve Outlook connectivity issues after moving mailbox to new Exchange 2016 server
Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now