Solved

Microsoft Exchange 2007 R2 Certificate errors Event ID 12014

Posted on 2013-06-02
7
663 Views
Last Modified: 2013-06-17
Hello EE:

here's the scenario.

Yesterday I noticed an expired certificate in and had event logs complaiining about it. After I replaced the expired cert with a new cert I began to receive a new Event ID: 12014. Which contains:
Microsoft Exchange could not find a certificate that contains the domain name data1.xxx.com in the personal store on the local computer. Therefore it is unable to support the STARTTLS SMTP verb for connector DefaultInternet w/ FQDN parameter of data1.xxx.com. Verify the connectors configuration and the installed certificate to make sure there is a certificate w/ a domain name for the FQDN.

My questions are:
1. How do I go back and look at the cert that had expired to see how it was configured? I am thinking that my new cert did not have the correct parameters for data1.xxx.com

2. The data1.xxx.com is our external DNS pointer for our MX records for xxx.com. So by the Event errors I am guessing that I need to take care of this error asap.

3. If i install/redo the cert; it is necessary to verify connectors and such. This Exchange has been in place for several years so I now it is set up and configured correctly.

Thanks in advance!
0
Comment
Question by:Group_007
  • 4
  • 2
7 Comments
 
LVL 19

Expert Comment

by:R--R
ID: 39214351
Run command from shell

get-exchangecertificate | fl
0
 
LVL 18

Accepted Solution

by:
suriyaehnop earned 500 total points
ID: 39214353
Answer to No.1, you must use Exchange Management Shell, Get-ExchangeCertificate on your Client Access Server role. The cmdlet will show the certificate name. To view more details of the certificate, use:

Get-ExchangeCertificate -Thumbprint <thumbprint ID>

Open in new window


Answer to No.2, please review the Subject Alternative Nam (SAN) on previous certificate (from no.1) to verify the dns name for data1.xxx exist or not, if yes, you have to re-generate the certificate with the provider with complete SAN names then install it and enable it for services.

Answer to No.3, get details and installed the correct certificate
0
 
LVL 1

Author Comment

by:Group_007
ID: 39214524
I have ran the command but I'm not sure what the parameter requirements need to be to regenerate the data1.xxx.com. I know how to run the cmd for certificates but I'm not sure how to view the old certificate that I had removed with the remove command.
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 
LVL 1

Author Comment

by:Group_007
ID: 39214533
Comment to answer 2: will do on your suggestion for answer 2 and will reply.
0
 
LVL 18

Expert Comment

by:suriyaehnop
ID: 39214537
Is the old certificate still available if view via MMC? To proceed further, please advice if you see certificate error while accessing Outlook Web Access? Create a new outlook profile using autodiscover and also run MS Connectivity settings (https://www.testexchangeconnectivity.com/) then post the result here
0
 
LVL 1

Author Comment

by:Group_007
ID: 39215011
Setting up a new profile makes it past the "allow" autodiscover prompt. But then complains about an encrypted connection to you mail server is not available. Click next to attempt using an unencrypted connection.
Log on to server (unencrypted). I then get a prompt to either configure manually. I try to connect manually using out companies webmail address. I get the error: The content source <mapi://{S-1-5-21-3461065400-4013944075-1299633618-1004}/> cannot be accessed.

Responce from Connectivity test:
Testing RPC/HTTP connectivity.
 The RPC/HTTP test failed.
 Test Steps
 ExRCA is attempting to test Autodiscover for tmcentire@kmgchemicals.com.
 Testing Autodiscover failed.
 Test Steps
 Attempting each method of contacting the Autodiscover service.
 The Autodiscover service couldn't be contacted successfully by any method.
 Test Steps
 Attempting to test potential Autodiscover URL https://kmgchemicals.com/AutoDiscover/AutoDiscover.xml
 Testing of this potential Autodiscover URL failed.
 Test Steps
 Attempting to resolve the host name kmgchemicals.com in DNS.
 The host name resolved successfully.
 Additional Details
 IP addresses returned: 70.42.5.173

Testing TCP port 443 on host kmgchemicals.com to ensure it's listening and open.
 The port was opened successfully.
Testing the SSL certificate to make sure it's valid.
 The SSL certificate failed one or more certificate validation checks.
 Test Steps
 ExRCA is attempting to obtain the SSL certificate from remote server kmgchemicals.com on port 443.
 ExRCA successfully obtained the remote SSL certificate.
 Additional Details
 Remote Certificate Subject: OU=Software appliances, O=TurnKey Linux, Issuer: OU=Software appliances, O=TurnKey Linux.

Validating the certificate name.
 Certificate name validation failed.
 Additional Details
 ExRCA couldn't parse the common name from certificate subject OU=Software appliances, O=TurnKey Linux.





Attempting to test potential Autodiscover URL https://autodiscover.kmgchemicals.com/AutoDiscover/AutoDiscover.xml
 Testing of this potential Autodiscover URL failed.
 Test Steps
 Attempting to resolve the host name autodiscover.kmgchemicals.com in DNS.
 The host name couldn't be resolved.
  Tell me more about this issue and how to resolve it
 Additional Details
 Host autodiscover.kmgchemicals.com couldn't be resolved in DNS InfoDomainNonexistent.



Attempting to contact the Autodiscover service using the HTTP redirect method.
 The attempt to contact Autodiscover using the HTTP Redirect method failed.
 Test Steps
 Attempting to resolve the host name autodiscover.kmgchemicals.com in DNS.
 The host name couldn't be resolved.
  Tell me more about this issue and how to resolve it
 Additional Details
 Host autodiscover.kmgchemicals.com couldn't be resolved in DNS InfoDomainNonexistent.



Attempting to contact the Autodiscover service using the DNS SRV redirect method.
 ExRCA failed to contact the Autodiscover service using the DNS SRV redirect method.
 Test Steps
 Attempting to locate SRV record _autodiscover._tcp.kmgchemicals.com in DNS.
 The Autodiscover SRV record was successfully retrieved from DNS.
 Additional Details
 The Service Location (SRV) record lookup returned host mail.kmgchemicals.com.

Attempting to test potential Autodiscover URL https://mail.kmgchemicals.com/Autodiscover/Autodiscover.xml
 Testing of this potential Autodiscover URL failed.
 Test Steps
 Attempting to resolve the host name mail.kmgchemicals.com in DNS.
 The host name couldn't be resolved.
  Tell me more about this issue and how to resolve it
 Additional Details
 Host mail.kmgchemicals.com couldn't be resolved in DNS InfoDomainNonexistent.
Exchange-autodiscover.docx
0
 
LVL 1

Author Comment

by:Group_007
ID: 39215090
So I think I need to create a new cert but Im not sure about the paramenters.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now