Solved

Microsoft Exchange 2007 R2 Certificate errors Event ID 12014

Posted on 2013-06-02
7
661 Views
Last Modified: 2013-06-17
Hello EE:

here's the scenario.

Yesterday I noticed an expired certificate in and had event logs complaiining about it. After I replaced the expired cert with a new cert I began to receive a new Event ID: 12014. Which contains:
Microsoft Exchange could not find a certificate that contains the domain name data1.xxx.com in the personal store on the local computer. Therefore it is unable to support the STARTTLS SMTP verb for connector DefaultInternet w/ FQDN parameter of data1.xxx.com. Verify the connectors configuration and the installed certificate to make sure there is a certificate w/ a domain name for the FQDN.

My questions are:
1. How do I go back and look at the cert that had expired to see how it was configured? I am thinking that my new cert did not have the correct parameters for data1.xxx.com

2. The data1.xxx.com is our external DNS pointer for our MX records for xxx.com. So by the Event errors I am guessing that I need to take care of this error asap.

3. If i install/redo the cert; it is necessary to verify connectors and such. This Exchange has been in place for several years so I now it is set up and configured correctly.

Thanks in advance!
0
Comment
Question by:Group_007
  • 4
  • 2
7 Comments
 
LVL 19

Expert Comment

by:R--R
ID: 39214351
Run command from shell

get-exchangecertificate | fl
0
 
LVL 18

Accepted Solution

by:
suriyaehnop earned 500 total points
ID: 39214353
Answer to No.1, you must use Exchange Management Shell, Get-ExchangeCertificate on your Client Access Server role. The cmdlet will show the certificate name. To view more details of the certificate, use:

Get-ExchangeCertificate -Thumbprint <thumbprint ID>

Open in new window


Answer to No.2, please review the Subject Alternative Nam (SAN) on previous certificate (from no.1) to verify the dns name for data1.xxx exist or not, if yes, you have to re-generate the certificate with the provider with complete SAN names then install it and enable it for services.

Answer to No.3, get details and installed the correct certificate
0
 
LVL 1

Author Comment

by:Group_007
ID: 39214524
I have ran the command but I'm not sure what the parameter requirements need to be to regenerate the data1.xxx.com. I know how to run the cmd for certificates but I'm not sure how to view the old certificate that I had removed with the remove command.
0
Why do Marketing keep bothering you?

Is your marketing department constantly asking for new email signature updates? Are they requesting a different design for every department? Do they need yet another banner added? Don’t let it get you down! There is an easy way to manage all of these requests...

 
LVL 1

Author Comment

by:Group_007
ID: 39214533
Comment to answer 2: will do on your suggestion for answer 2 and will reply.
0
 
LVL 18

Expert Comment

by:suriyaehnop
ID: 39214537
Is the old certificate still available if view via MMC? To proceed further, please advice if you see certificate error while accessing Outlook Web Access? Create a new outlook profile using autodiscover and also run MS Connectivity settings (https://www.testexchangeconnectivity.com/) then post the result here
0
 
LVL 1

Author Comment

by:Group_007
ID: 39215011
Setting up a new profile makes it past the "allow" autodiscover prompt. But then complains about an encrypted connection to you mail server is not available. Click next to attempt using an unencrypted connection.
Log on to server (unencrypted). I then get a prompt to either configure manually. I try to connect manually using out companies webmail address. I get the error: The content source <mapi://{S-1-5-21-3461065400-4013944075-1299633618-1004}/> cannot be accessed.

Responce from Connectivity test:
Testing RPC/HTTP connectivity.
 The RPC/HTTP test failed.
 Test Steps
 ExRCA is attempting to test Autodiscover for tmcentire@kmgchemicals.com.
 Testing Autodiscover failed.
 Test Steps
 Attempting each method of contacting the Autodiscover service.
 The Autodiscover service couldn't be contacted successfully by any method.
 Test Steps
 Attempting to test potential Autodiscover URL https://kmgchemicals.com/AutoDiscover/AutoDiscover.xml
 Testing of this potential Autodiscover URL failed.
 Test Steps
 Attempting to resolve the host name kmgchemicals.com in DNS.
 The host name resolved successfully.
 Additional Details
 IP addresses returned: 70.42.5.173

Testing TCP port 443 on host kmgchemicals.com to ensure it's listening and open.
 The port was opened successfully.
Testing the SSL certificate to make sure it's valid.
 The SSL certificate failed one or more certificate validation checks.
 Test Steps
 ExRCA is attempting to obtain the SSL certificate from remote server kmgchemicals.com on port 443.
 ExRCA successfully obtained the remote SSL certificate.
 Additional Details
 Remote Certificate Subject: OU=Software appliances, O=TurnKey Linux, Issuer: OU=Software appliances, O=TurnKey Linux.

Validating the certificate name.
 Certificate name validation failed.
 Additional Details
 ExRCA couldn't parse the common name from certificate subject OU=Software appliances, O=TurnKey Linux.





Attempting to test potential Autodiscover URL https://autodiscover.kmgchemicals.com/AutoDiscover/AutoDiscover.xml
 Testing of this potential Autodiscover URL failed.
 Test Steps
 Attempting to resolve the host name autodiscover.kmgchemicals.com in DNS.
 The host name couldn't be resolved.
  Tell me more about this issue and how to resolve it
 Additional Details
 Host autodiscover.kmgchemicals.com couldn't be resolved in DNS InfoDomainNonexistent.



Attempting to contact the Autodiscover service using the HTTP redirect method.
 The attempt to contact Autodiscover using the HTTP Redirect method failed.
 Test Steps
 Attempting to resolve the host name autodiscover.kmgchemicals.com in DNS.
 The host name couldn't be resolved.
  Tell me more about this issue and how to resolve it
 Additional Details
 Host autodiscover.kmgchemicals.com couldn't be resolved in DNS InfoDomainNonexistent.



Attempting to contact the Autodiscover service using the DNS SRV redirect method.
 ExRCA failed to contact the Autodiscover service using the DNS SRV redirect method.
 Test Steps
 Attempting to locate SRV record _autodiscover._tcp.kmgchemicals.com in DNS.
 The Autodiscover SRV record was successfully retrieved from DNS.
 Additional Details
 The Service Location (SRV) record lookup returned host mail.kmgchemicals.com.

Attempting to test potential Autodiscover URL https://mail.kmgchemicals.com/Autodiscover/Autodiscover.xml
 Testing of this potential Autodiscover URL failed.
 Test Steps
 Attempting to resolve the host name mail.kmgchemicals.com in DNS.
 The host name couldn't be resolved.
  Tell me more about this issue and how to resolve it
 Additional Details
 Host mail.kmgchemicals.com couldn't be resolved in DNS InfoDomainNonexistent.
Exchange-autodiscover.docx
0
 
LVL 1

Author Comment

by:Group_007
ID: 39215090
So I think I need to create a new cert but Im not sure about the paramenters.
0

Featured Post

Are your corporate email signatures appalling?

Is it scary how unprofessional your email signatures look? Do users create their own terrible designs and give themselves stupid job titles? You can make this a lot easier for yourself by choosing an email signature management solution from Exclaimer today.

Join & Write a Comment

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This process describes the steps required to Import and Export data from and to .pst files using Exchange 2010. We can use these steps to export data from a user to a .pst file, import data back to the same or a different user, or even import data t…
In this video we show how to create an Accepted Domain in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Ac…
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now