Solved

How to go from UCC SSL Certificate for Autodiscover, OWA e.t.c. to simple self signed certificate on Server 2008 SBS

Posted on 2011-02-11
7
794 Views
Last Modified: 2012-05-11
Hi all,

For reasons best not explained I have a few 2008 SBS Servers which were set up in an overly complicated way with regard to SSL.  I was originally told that to get SBS running properly I had to create external sub domains for autodiscover.domain.com and owa.autodiscover.com e.t.c then get a multi domain (UCC) SSL certificate to cover all the various names and I've done all of this and everything has worked fine.  I've since found out that I no longer need to go down this route and Server 2008 has been tweaked to make things a bit easier.  I've been told that really I could make do with a simple self-signed certificate generated by the server and with just that autodiscover, OWA, Outlook Anywhere e.t.c. will still work just fine.

My question is, how can I "convert" a server that has an expired UCC certificate for autodiscover and owa e.t.c. to one that will function with a self-signed certificate, and how will it affect existing users laptops using Outlook Anywhere, iPhones e.t.c.?

Many thanks

Adam
0
Comment
Question by:amlydiate
  • 3
  • 3
7 Comments
 
LVL 35

Expert Comment

by:Cris Hanna
ID: 34873113
If you make the switch back, every remote device you have...laptops, phones, etc, will be affected and have to be completely re-setup manually.

If you've had this working...simply renew the cert...you'll be much happier and take lots less time
0
 
LVL 22

Expert Comment

by:Larry Struckmeyer MVP
ID: 34873841
Optionally you could purchase single SSL certs... less than $15/yr for some.  But as Chris points  out you will have to visit every device that depends on the cert.
0
 

Author Comment

by:amlydiate
ID: 34876620
Ok but what would I have to do on each device if I changed?
0
Resolve Critical IT Incidents Fast

If your data, services or processes become compromised, your organization can suffer damage in just minutes and how fast you communicate during a major IT incident is everything. Learn how to immediately identify incidents & best practices to resolve them quickly and effectively.

 
LVL 35

Expert Comment

by:Cris Hanna
ID: 34876847
you would have to manually install the self signed cert on all laptops and Windows Mobile Devices
You would have re-run the Exchange Setup on Iphones and ignore the cert warning
0
 

Author Comment

by:amlydiate
ID: 34877328
Brilliant thank you, so as a last question, what do I actually have to do to remove the old certificate and create a new one? I definitely won't end up with autodiscover prompts in outlook as a result of this?

Thanks

Adam
0
 
LVL 35

Accepted Solution

by:
Cris Hanna earned 500 total points
ID: 34879109
ahhh now that's a whole different issue and it is possible you could depending on your configuration.
Some other SBS MVPs have addressed Autodiscover in their blogs
http://www.thirdtier.net/2009/02/setting-up-an-external-autodiscover-record-for-sbs-2008/
http://msmvps.com/blogs/bradley/archive/2008/12/18/autodiscover-and-dns.aspx
no real need to remove the old cert since it's expired
Just re-run the Setup My Internet Address wizard, select I already have a domain name and select "I want to manage it myself".   When you get to the box to put in your domain name just enter company.com (whatever is appropriate)    By default the certificate will be created for remote.domainname.com    If you wish the certificate for something other than that, click on the Advanced link underneath where you enter your domain name and replace "remote" with mail or whatever.

Complete the wizard
The follow this blog for deploying the new cert to remote devices
http://blogs.technet.com/b/sbs/archive/2008/09/30/how-do-i-distribute-the-sbs-2008-self-signed-ssl-certificate-to-my-users.aspx
0
 

Author Closing Comment

by:amlydiate
ID: 35209842
Thanks that worked a treat!
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

The problem of the system drive in SBS 2003 getting full continues to be an issue, even though SBS 2008 and SBS 2011 are both in the market place.  There are several solutions to this, including adding additional drive space or using third party uti…
Because virtualization becomes more and more common, and, with Microsoft Hyper-V included in Windows Server at no additional costs, and, most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 201…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

697 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question