Solved

Microsoft Exchange 2007 R2 Certificate errors Event ID 12014

Posted on 2013-06-02
7
665 Views
Last Modified: 2013-06-17
Hello EE:

here's the scenario.

Yesterday I noticed an expired certificate in and had event logs complaiining about it. After I replaced the expired cert with a new cert I began to receive a new Event ID: 12014. Which contains:
Microsoft Exchange could not find a certificate that contains the domain name data1.xxx.com in the personal store on the local computer. Therefore it is unable to support the STARTTLS SMTP verb for connector DefaultInternet w/ FQDN parameter of data1.xxx.com. Verify the connectors configuration and the installed certificate to make sure there is a certificate w/ a domain name for the FQDN.

My questions are:
1. How do I go back and look at the cert that had expired to see how it was configured? I am thinking that my new cert did not have the correct parameters for data1.xxx.com

2. The data1.xxx.com is our external DNS pointer for our MX records for xxx.com. So by the Event errors I am guessing that I need to take care of this error asap.

3. If i install/redo the cert; it is necessary to verify connectors and such. This Exchange has been in place for several years so I now it is set up and configured correctly.

Thanks in advance!
0
Comment
Question by:Group_007
  • 4
  • 2
7 Comments
 
LVL 19

Expert Comment

by:R--R
ID: 39214351
Run command from shell

get-exchangecertificate | fl
0
 
LVL 18

Accepted Solution

by:
suriyaehnop earned 500 total points
ID: 39214353
Answer to No.1, you must use Exchange Management Shell, Get-ExchangeCertificate on your Client Access Server role. The cmdlet will show the certificate name. To view more details of the certificate, use:

Get-ExchangeCertificate -Thumbprint <thumbprint ID>

Open in new window


Answer to No.2, please review the Subject Alternative Nam (SAN) on previous certificate (from no.1) to verify the dns name for data1.xxx exist or not, if yes, you have to re-generate the certificate with the provider with complete SAN names then install it and enable it for services.

Answer to No.3, get details and installed the correct certificate
0
 
LVL 1

Author Comment

by:Group_007
ID: 39214524
I have ran the command but I'm not sure what the parameter requirements need to be to regenerate the data1.xxx.com. I know how to run the cmd for certificates but I'm not sure how to view the old certificate that I had removed with the remove command.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 1

Author Comment

by:Group_007
ID: 39214533
Comment to answer 2: will do on your suggestion for answer 2 and will reply.
0
 
LVL 18

Expert Comment

by:suriyaehnop
ID: 39214537
Is the old certificate still available if view via MMC? To proceed further, please advice if you see certificate error while accessing Outlook Web Access? Create a new outlook profile using autodiscover and also run MS Connectivity settings (https://www.testexchangeconnectivity.com/) then post the result here
0
 
LVL 1

Author Comment

by:Group_007
ID: 39215011
Setting up a new profile makes it past the "allow" autodiscover prompt. But then complains about an encrypted connection to you mail server is not available. Click next to attempt using an unencrypted connection.
Log on to server (unencrypted). I then get a prompt to either configure manually. I try to connect manually using out companies webmail address. I get the error: The content source <mapi://{S-1-5-21-3461065400-4013944075-1299633618-1004}/> cannot be accessed.

Responce from Connectivity test:
Testing RPC/HTTP connectivity.
 The RPC/HTTP test failed.
 Test Steps
 ExRCA is attempting to test Autodiscover for tmcentire@kmgchemicals.com.
 Testing Autodiscover failed.
 Test Steps
 Attempting each method of contacting the Autodiscover service.
 The Autodiscover service couldn't be contacted successfully by any method.
 Test Steps
 Attempting to test potential Autodiscover URL https://kmgchemicals.com/AutoDiscover/AutoDiscover.xml
 Testing of this potential Autodiscover URL failed.
 Test Steps
 Attempting to resolve the host name kmgchemicals.com in DNS.
 The host name resolved successfully.
 Additional Details
 IP addresses returned: 70.42.5.173

Testing TCP port 443 on host kmgchemicals.com to ensure it's listening and open.
 The port was opened successfully.
Testing the SSL certificate to make sure it's valid.
 The SSL certificate failed one or more certificate validation checks.
 Test Steps
 ExRCA is attempting to obtain the SSL certificate from remote server kmgchemicals.com on port 443.
 ExRCA successfully obtained the remote SSL certificate.
 Additional Details
 Remote Certificate Subject: OU=Software appliances, O=TurnKey Linux, Issuer: OU=Software appliances, O=TurnKey Linux.

Validating the certificate name.
 Certificate name validation failed.
 Additional Details
 ExRCA couldn't parse the common name from certificate subject OU=Software appliances, O=TurnKey Linux.





Attempting to test potential Autodiscover URL https://autodiscover.kmgchemicals.com/AutoDiscover/AutoDiscover.xml
 Testing of this potential Autodiscover URL failed.
 Test Steps
 Attempting to resolve the host name autodiscover.kmgchemicals.com in DNS.
 The host name couldn't be resolved.
  Tell me more about this issue and how to resolve it
 Additional Details
 Host autodiscover.kmgchemicals.com couldn't be resolved in DNS InfoDomainNonexistent.



Attempting to contact the Autodiscover service using the HTTP redirect method.
 The attempt to contact Autodiscover using the HTTP Redirect method failed.
 Test Steps
 Attempting to resolve the host name autodiscover.kmgchemicals.com in DNS.
 The host name couldn't be resolved.
  Tell me more about this issue and how to resolve it
 Additional Details
 Host autodiscover.kmgchemicals.com couldn't be resolved in DNS InfoDomainNonexistent.



Attempting to contact the Autodiscover service using the DNS SRV redirect method.
 ExRCA failed to contact the Autodiscover service using the DNS SRV redirect method.
 Test Steps
 Attempting to locate SRV record _autodiscover._tcp.kmgchemicals.com in DNS.
 The Autodiscover SRV record was successfully retrieved from DNS.
 Additional Details
 The Service Location (SRV) record lookup returned host mail.kmgchemicals.com.

Attempting to test potential Autodiscover URL https://mail.kmgchemicals.com/Autodiscover/Autodiscover.xml
 Testing of this potential Autodiscover URL failed.
 Test Steps
 Attempting to resolve the host name mail.kmgchemicals.com in DNS.
 The host name couldn't be resolved.
  Tell me more about this issue and how to resolve it
 Additional Details
 Host mail.kmgchemicals.com couldn't be resolved in DNS InfoDomainNonexistent.
Exchange-autodiscover.docx
0
 
LVL 1

Author Comment

by:Group_007
ID: 39215090
So I think I need to create a new cert but Im not sure about the paramenters.
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

861 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question