Solved

How to go from UCC SSL Certificate for Autodiscover, OWA e.t.c. to simple self signed certificate on Server 2008 SBS

Posted on 2011-02-11
7
792 Views
Last Modified: 2012-05-11
Hi all,

For reasons best not explained I have a few 2008 SBS Servers which were set up in an overly complicated way with regard to SSL.  I was originally told that to get SBS running properly I had to create external sub domains for autodiscover.domain.com and owa.autodiscover.com e.t.c then get a multi domain (UCC) SSL certificate to cover all the various names and I've done all of this and everything has worked fine.  I've since found out that I no longer need to go down this route and Server 2008 has been tweaked to make things a bit easier.  I've been told that really I could make do with a simple self-signed certificate generated by the server and with just that autodiscover, OWA, Outlook Anywhere e.t.c. will still work just fine.

My question is, how can I "convert" a server that has an expired UCC certificate for autodiscover and owa e.t.c. to one that will function with a self-signed certificate, and how will it affect existing users laptops using Outlook Anywhere, iPhones e.t.c.?

Many thanks

Adam
0
Comment
Question by:amlydiate
  • 3
  • 3
7 Comments
 
LVL 35

Expert Comment

by:Cris Hanna
ID: 34873113
If you make the switch back, every remote device you have...laptops, phones, etc, will be affected and have to be completely re-setup manually.

If you've had this working...simply renew the cert...you'll be much happier and take lots less time
0
 
LVL 21

Expert Comment

by:Larry Struckmeyer MVP
ID: 34873841
Optionally you could purchase single SSL certs... less than $15/yr for some.  But as Chris points  out you will have to visit every device that depends on the cert.
0
 

Author Comment

by:amlydiate
ID: 34876620
Ok but what would I have to do on each device if I changed?
0
ScreenConnect 6.0 Free Trial

Discover new time-saving features in one game-changing release, ScreenConnect 6.0, based on partner feedback. New features include a redesigned UI, app configurations and chat acknowledgement to improve customer engagement!

 
LVL 35

Expert Comment

by:Cris Hanna
ID: 34876847
you would have to manually install the self signed cert on all laptops and Windows Mobile Devices
You would have re-run the Exchange Setup on Iphones and ignore the cert warning
0
 

Author Comment

by:amlydiate
ID: 34877328
Brilliant thank you, so as a last question, what do I actually have to do to remove the old certificate and create a new one? I definitely won't end up with autodiscover prompts in outlook as a result of this?

Thanks

Adam
0
 
LVL 35

Accepted Solution

by:
Cris Hanna earned 500 total points
ID: 34879109
ahhh now that's a whole different issue and it is possible you could depending on your configuration.
Some other SBS MVPs have addressed Autodiscover in their blogs
http://www.thirdtier.net/2009/02/setting-up-an-external-autodiscover-record-for-sbs-2008/
http://msmvps.com/blogs/bradley/archive/2008/12/18/autodiscover-and-dns.aspx
no real need to remove the old cert since it's expired
Just re-run the Setup My Internet Address wizard, select I already have a domain name and select "I want to manage it myself".   When you get to the box to put in your domain name just enter company.com (whatever is appropriate)    By default the certificate will be created for remote.domainname.com    If you wish the certificate for something other than that, click on the Advanced link underneath where you enter your domain name and replace "remote" with mail or whatever.

Complete the wizard
The follow this blog for deploying the new cert to remote devices
http://blogs.technet.com/b/sbs/archive/2008/09/30/how-do-i-distribute-the-sbs-2008-self-signed-ssl-certificate-to-my-users.aspx
0
 

Author Closing Comment

by:amlydiate
ID: 35209842
Thanks that worked a treat!
0

Featured Post

ScreenConnect 6.0 Free Trial

Explore all the enhancements in one game-changing release, ScreenConnect 6.0, based on partner feedback. New features include a redesigned UI, app configurations and chat acknowledgement to improve customer engagement!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Microsoft  Partnership 1 80
stirling engine recommendation or other cool techie gift? 2 69
Unable to edit save GPO not enough disk space 11 42
Exchange 2007 3 35
This guide is intended for migrating Windows 2003 Standard with Exchange 2003 to Windows Small Business Server 2008. You will need the following: Exchange Best Practice Analyzer: http://www.microsoft.com/downloads/details.aspx?FamilyID=DBAB201F-…
You may have discovered the 'Compatibility View Settings' workaround for making your SBS 2008 Remote Web Workplace 'connect to a computer' section stops 'working around' after a Windows 10 client upgrade.  That can be fixed so it 'works around' agai…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question