How to handle certificate(s)s when migrating from exchange 2003>2010 with no downtime.
Hello.
I am about to migrate a customers exchange 2003>2010. I will not be able to migrate all mailboxes at the same time so i have to have a co-op working solution. And i need help to see if i am thinking the right way regarding webmail certificate to have no downtime on mobile sync etc if the mailbox is still on exchange 2003 or moved to 2010.
Is this the correct way to go about it?
- I buy a new san certificate. In it i put current webmail address, autodiscover record and new legacy name for exchange 2003.
- I install this certificate on exchange 2010. Change correct path etc to point exchange 2003 to the legacy name.
- Export the certificate from exchange 2010.
- Import and replace exchange 2003 certificate with that certificate.
- Change firewall to point to exchange 2010.
Mobile sync is still on same webmailaddress. Exchange 2010 will redirect internally if user has the mailbox still on exchange 2003.
Is this correct? If not please give instructions on better solution.
If this is correct it would also be great to have exact scripts needed to set correct addresses on exchange 2010 server for webmail, autodiscover,legacy and how to export the cert from exchange 2010.
Thanks in advance.
I am about to migrate a customers exchange 2003>2010. I will not be able to migrate all mailboxes at the same time so i have to have a co-op working solution. And i need help to see if i am thinking the right way regarding webmail certificate to have no downtime on mobile sync etc if the mailbox is still on exchange 2003 or moved to 2010.
Is this the correct way to go about it?
- I buy a new san certificate. In it i put current webmail address, autodiscover record and new legacy name for exchange 2003.
- I install this certificate on exchange 2010. Change correct path etc to point exchange 2003 to the legacy name.
- Export the certificate from exchange 2010.
- Import and replace exchange 2003 certificate with that certificate.
- Change firewall to point to exchange 2010.
Mobile sync is still on same webmailaddress. Exchange 2010 will redirect internally if user has the mailbox still on exchange 2003.
Is this correct? If not please give instructions on better solution.
If this is correct it would also be great to have exact scripts needed to set correct addresses on exchange 2010 server for webmail, autodiscover,legacy and how to export the cert from exchange 2010.
Thanks in advance.
Your approach looks right.
There will be a momentary outage when you import the new certificate on Exch2003
try this link to get more info:
http://www.networkworld.com/community/node/58685
There will be a momentary outage when you import the new certificate on Exch2003
try this link to get more info:
http://www.networkworld.com/community/node/58685
ASKER
Thanks for the answers. So i look to have the correct approach. Just a clarification..
As far as i know i can create this san certificate with a csr directly on the certificate providers website when buying it. Its also not a problem that i already have one quick ssl certificate with the same name and it will be active. So is it still neccesary for me to generate the certificate on the exchange 2010 server first? Im guessing that perhaps during the installation of exchange 2010 i will generate a self signed certificate for this that i need to replace or can i forgo that?
As far as i know i can create this san certificate with a csr directly on the certificate providers website when buying it. Its also not a problem that i already have one quick ssl certificate with the same name and it will be active. So is it still neccesary for me to generate the certificate on the exchange 2010 server first? Im guessing that perhaps during the installation of exchange 2010 i will generate a self signed certificate for this that i need to replace or can i forgo that?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Set-OWAVirtualDirectory Seattle-EX10\OWA* -ExternalURL https://mail.contoso.com/OWA
-Exchange2003URL https://legacy.contoso.com/exchange
you have to generate the the certificate on the exchange 2010 server
you need to enable Integrated Windows authentication on the Microsoft-Server-ActiveSyn