manage multiple certificate on SBS 2011 with Exchange 2010

Posted on 2012-09-01
Last Modified: 2012-10-11

We have a client that has 2 ISP’s i.e. Ethernet and cable company.  Primary is our Ethernet ISP and cable is the backup on Sonicwall.  They have SBS 2011 with exchange 2010 installed.  Primary ISP’s A record is and secondary is  We have purchased certificates for both Mail1 and Mail2 for mydomain from same CA but Exchange  only allows one to be active at a time.  If internet on Primary goes down then we have to manually change to Mail2 certificate.  Is it possible to have this automated so we don’t have to do this manually.  I am open for different ideas on how to setup certificates.

Question by:ShamanSys
    LVL 17

    Expert Comment

    by:Kent Dyer
    Cerutil or certificate store (in either IE and/or Firefox) on the computer should be able to allow/install multiple certs..  This should cover what you need to manage multiple certs on your server.


    LVL 13

    Expert Comment

    Easiest fix is a wildcard certificate *
    Or even a uc certificate with a subject alternate name .. That way you have 1 and the same certificate.
    LVL 76

    Expert Comment

    You can have mail1 point to both IPs.

    Alternatively, you could add an additional smtp receiver that is bound to another IP to which the cable IP is configured to forward then attach the second certificate to that receiver.
    LVL 77

    Assisted Solution

    by:Rob Williams
    There are other problems to consider, the server will always respond to the default gateway and you cannot have two.  You need a dual WAN port router and most will not allow forwarding on both WAN connections.

    You cannot set up Reverse DNS on both connections.

    Most SBS sites simply use a backup mail service such as no-ip's BackUp MX, about $35/year
    LVL 74

    Accepted Solution

    It seems as though what you are trying to accomplish is to have redundancy for inbound email using a failover.  You cannot use separate host names for this -- BOTH need to be  Exchange will only announce itself with a single name. So this eliminates the problem you are trying to resolve.

    You would then need to just set up TWO MX records with the same host name ( each pointing to the different IP addresses, with your main one having a higher priority weight (lower number) number than the other.

    Contrary to what Rob stated above, it may be possible to set up Reverse DNS (PTR) on both connections to be the same (ie, just There are a few other considerations and this is a good discussion about those:  http:Q_24980487.html

    Sonicwall will handle an automatic failover configuration just fine.

    If you cannot get your ISPs to provide you with the proper reverse DNS though, then you need to use a backup MX as Rob suggested above.


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Welcome to my series of short tips on migrations. Whilst based on Microsoft migrations the same principles can be applied to any type of migration. My first tip Migration Tip #1 – Source Server Health can be found listed in my profile here: http:…
    I’m often asked about newer and larger USB drives connected to SBS2008 and 2011 failing Windows Server Backup vs the older USB drives not failing. As disk space continues to grow and drive technology change SBS2008 and some SBS2011 end up with the f…
    Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
    Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now