[Last Call] Learn about multicloud storage options and how to improve your company's cloud strategy. Register Now

x
?
Solved

Wilcard and Self-Signed Certificates - Exchange 2010 upgrade

Posted on 2011-03-11
9
Medium Priority
?
560 Views
Last Modified: 2012-05-11
We already own certificates and more importantly a wildcard certificate for our domain.  During the upgrade to Exchange 2010 from Exchange 2003, we need to make sure that we can use the wildcard to minimize downtime.  If we were to request new certificates, we would have to revoke the current certificates meaning we'd have untrusted connections for end-users until we get the new certificate generated.

If we use a wildcard certificate on our externally facing Load Balancers and do self signed certificates internally, will this work for Exchange 2010 and 2003 during coexistence?  I seem to think it will since the wildcard is a catch-all and will work for the new legacy.domain.com and the older mail.domain.com along with autodiscover.domain.com.

Can we do this?
0
Comment
Question by:liquid101
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
9 Comments
 
LVL 74

Accepted Solution

by:
Glen Knight earned 2000 total points
ID: 35108249
it should work, you don't need to use self signed though, you can just import the wildcard certificate in to Exchange 2010.

What sort of load balancer are you using?
0
 
LVL 1

Author Comment

by:liquid101
ID: 35108311
We have F5 Load Balancers to work with.  I'm not sure of the model, though, but it's a pretty sweet box.  I'm just now getting a good handle on what it is capable of from the subject matter expert on the team here.
0
 
LVL 2

Expert Comment

by:ITengineer
ID: 35108317
What kind of exchange setup do you have? one server for each role?
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 1

Author Comment

by:liquid101
ID: 35108363
The 2003 setup is 2 front-end OWA boxes, 1 Transport Box, and 3 Mailbox servers.  

We're looking at 2 CAS/HUB (Dual role) and 3 Mailbox servers for the 2010 setup.  We're also debating SSL offloading at the F5s to help with CPU load on the front-end servers.  No UM or Edge in the setup as we already have hardware SPAM and Anti-Virus boxes.

We're really hesitant though with such a large user-base.  Once we start the upgrade, we want to make sure that it's as seamless as possible.
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 35108386
Whatever you do you will need to have the CAS and the Front End servers available externally at the same time.  Exchange 2010 will redirect the clients to the legacy URL so this will also need to be created.  You should really just use a CAS Array and point the clients at this, there is no need to use a load balancer since the CAS array uses NLB
0
 
LVL 1

Author Comment

by:liquid101
ID: 35108470
We're staying away from the software LB solution since the old front-end is already Load Balanced through the same hardware.  By creating a new VIP, we're hoping that it will redirect almost instantly with the new external DNS change.  Here's the hardware load balancing article that I've been reading for Exchange 2010:  http://goo.gl/kDNNF  
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 35108482
OK, that's fine.  You will still require the legacyURL and an additional IP address.

And as already stated, you can just import the wildcard certificate so there is no need to use self signed certs.
0
 
LVL 1

Author Comment

by:liquid101
ID: 35108499
Thanks for the good feedback!  I have yet to find anyone who's had anything "break" during the upgrade to 2010, but we still have to be cautious.
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 35108506
I have done quite a few in my time and documented them in articles both here on EE and on my blog, if you do them carefully and allow appropriate amounts of time there is no reason why anything should go wrong.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

On September 18, Experts Exchange launched the first installment of the Help Bell, a new feature for Premium Members, Team Accounts, and Qualified Experts. The Help Bell will serve as an additional tool to help teams increase question visibility.
The main intent of this article is to make you aware of ‘Exchange fail to mount’ error, its effects, causes, and solution.
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…
Suggested Courses

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question