Solved

Certificates and Outlook Anywhere

Posted on 2011-02-25
13
633 Views
Last Modified: 2012-05-11
Recent upgrade of SBS2003 to Server 2K8R2 and Exchange 2010.  Finally got it working... mostly but SSL and server names from intra and internet is doing my head in.  I'm trying to get Outlook Anywhere working and would really like some pointers.

Here's the details:
I have a 2K8R2 AD GC and Exchange 2010 - svrname.domain.local
There are 3 other 2K3 servers still in the domain replicating DNS including the old SBS2K3 which I can't remove properly until I find the SBS discs which have been relocated in a move between offices.
I have an external domain - mydomain.com.au
I have DNS registered for mail, owa, outlook and autodiscover pointing to my public IP
I have local DNS pointers for all the above pointing to svrname
I have an EV SSL Cert from GoDaddy for owa.mydomain.com.au
I have the approriate ports on my ASA5500 open with rules for access and NAT to svrname's private IP.

Users have their Exchange accounts in the office but get certificate warnings
owa.mydomain.com.au/owa works perfectly intra and internet with secure 'green' address
My Blackberry and iPhone users have zero problems
Adding Exchange to Outlook from the Internet:
My Name, my.name@mydomain.com.au and password entered and it starts online search for server settings.  
Establishes network connection then a security alert for name mismatch autodiscover.mydomain.com.au because the certificate is owa.mydomain.com.au.
Click yes and a password request popsup for my.name@mydomain.com.au, change user and enter domain\my.name and the password and get Outlook must be online error.
It then presents a Microsoft Exchange dialogue box with:
Microsoft Exchange Server: SVRNAME.domain.local
Mailbox: =SMTP:my.name@mydomain.com.au
I cancel that box, it ticks searching for server settings for my.name@mydomain.com.au then fails to logon to the server and throws the Outlook must be online error again.

Obviously I've stuffed names somewhere but I know not where.  Everthing I've found online I have followed, GUI Exchange management and Exchange shell setting server names to match the certificate but nothing appears to work unless I use my basic SSL for IIS with CN: mydomain.com.au but then OWA stops working with a 403 .

Having said all that, I'm at home but can get to the office quickly (I haven't set up a VPN for RDP yet) and provide as much info as any of you may request
0
Comment
Question by:Jalbkay
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
13 Comments
 
LVL 19

Expert Comment

by:R--R
ID: 34985371
Include the autodiscover.mydomain.com.au in the SAN certificate with the help of your SSL CA.
0
 

Author Comment

by:Jalbkay
ID: 34985392
As simple as that?  So I can have multiple names on my certificate?  I was wondering as I created the request in Exchange 2010 and made sure owa, outlook and autodiscover were all listed with owa.mydomain.com.au listed as the CN but the certificate only seems to advertise the CN... I'll logon to GoDaddy right now and discuss, thanks R-R!
0
 
LVL 6

Expert Comment

by:Joking
ID: 34985633
You want a UCC cert (one that supports subject alternate names). GoDaddy supports I think 5 names on a single cert for $89 US, or something like that...
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:Jalbkay
ID: 35003301
OK, so I have a new UCC from GoDaddy with:
mydomain.com.au
autodiscover.mydomain.com.au
outlook.mydomain.com.au
owa.mydomain.com.au, and
mail.mydomain.com.au

Same symptoms: Adding Exchange to Outlook from the Internet:
My Name, my.name@mydomain.com.au and password entered and it starts online search for server settings.  
Establishes network connection then a security alert for name mismatch autodiscover.mydomain.com.au because the certificate is owa.mydomain.com.au.
Click yes and a password request popsup for my.name@mydomain.com.au, change user and enter domain\my.name and the password and get Outlook must be online error.
It then presents a Microsoft Exchange dialogue box with:
Microsoft Exchange Server: SVRNAME.domain.local
Mailbox: =SMTP:my.name@mydomain.com.au
I cancel that box, it ticks searching for server settings for my.name@mydomain.com.au then fails to logon to the server and throws the Outlook must be online error again.

Thoughts?

0
 
LVL 49

Expert Comment

by:Akhater
ID: 35005012
there is something wrong

1. do you have any reverse proxy before your exchange ? like ISA or anything ?
2. when you go to https://owa.mydomain.com/owa and check the certificate is it showing the new one you bought from GoDaddy
3. did you enable the new one in Exchange for IIS use ?

0
 

Author Comment

by:Jalbkay
ID: 35006086
Hi Akhater,

1. No
2. Yes
3. Yes

The Exchange Connectivty tester gives green ticks all the way so I'm at a loss
0
 
LVL 49

Expert Comment

by:Akhater
ID: 35006169
if the testexchangeconnectivity gives you green then it is workinng

would it be possible for you to create a test username/pass for me so i can help ?
0
 

Author Comment

by:Jalbkay
ID: 35012034
Sure, give me a contact email and I'll send info through... pity there's no PM function in EE.
0
 
LVL 49

Expert Comment

by:Akhater
ID: 35012082
i have a way to contact me in my profile
0
 

Author Comment

by:Jalbkay
ID: 35012553
Found and done!
0
 
LVL 49

Accepted Solution

by:
Akhater earned 500 total points
ID: 35013153
ok i guess i found your problem

run a get-outlookprovider do you have in expr CertPrincipalName msstd:*.domain.com.au ?

if so run a


Set-OutlookProvider EXPR  -CertPrincipalName msstd:domain.com.au


0
 

Author Comment

by:Jalbkay
ID: 35013244
That was the last piece of the puzzle, thanks Akhater.  I'd just been through and set all three Outlook Provider (EXPR, EXCH & WEB) to server $null which you had suggested in another post but I'd also wildcarded the cert name.  Cheers
0
 
LVL 49

Expert Comment

by:Akhater
ID: 35013257
glad i've helped

thanks for the points
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Are you unable to connect or configure Hotmail email account in Microsoft Outlook 2010, 2007? Or Outlook.com emails are not downloading to Outlook? Lets’ see the problem and resolve Outlook Connector error syncing folder hierarchy (0x8004102A).
A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question