SBS 2003 Migration to Office 365 certificate challenges
Hi there,
We are having a challenge I'm hoping the community can help with:
Working to do a staged batch migration from SBS 2003 to Office 365. The migration tools will not connect as there isn't a 3rd party certificate in place...only the self-signed.
Question: Can we add a simple public CA certificate to the existing server in ADDITION to the in-place self-signed one? There are numerous remote stations connecting with RPC/HTTP and we do not want to break that process. We have not found any specific resources for adding another third party certificate (autodiscover.domainame.xx
In trying to create the CSR - the only option is to manipulate the self-signed; again we need to protect the integrity of RPC/http as it is now.
All mailboxes are moving; no federation - this is for a non-profit so resources are scarce :-)
Thank you in advance for your thoughts.
AG
We are having a challenge I'm hoping the community can help with:
Working to do a staged batch migration from SBS 2003 to Office 365. The migration tools will not connect as there isn't a 3rd party certificate in place...only the self-signed.
Question: Can we add a simple public CA certificate to the existing server in ADDITION to the in-place self-signed one? There are numerous remote stations connecting with RPC/HTTP and we do not want to break that process. We have not found any specific resources for adding another third party certificate (autodiscover.domainame.xx
In trying to create the CSR - the only option is to manipulate the self-signed; again we need to protect the integrity of RPC/http as it is now.
All mailboxes are moving; no federation - this is for a non-profit so resources are scarce :-)
Thank you in advance for your thoughts.
AG
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Good plan Simon. Not thought of doing it that way before.
Alan
Alan
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SBS 2003 doesn't support Autodiscover, so putting autodiscover in the certificate isn't going to help.
As long as you get the certificate for the same host name that the clients are currently using, they will not get an error.
Simon.
As long as you get the certificate for the same host name that the clients are currently using, they will not get an error.
Simon.
ASKER
I understand; remember, the purpose for doing this is to get O365 to talk to the exchange server for the purpose of migration. I need to know what will make that work as it should. I can put "autodiscover" in if that allows it to connect and get mailboxes moving if needed.
When running the exchangeconnectivity analyzer for outlook anywhere (RPC) I get the following failure:
"The certificate chain didn't end in a trusted root. Root = CN=domainname.org, CN=companyweb, CN=servernamer, CN=localhost, CN=servername.XX.local"
The migration batch cannot connect to get the mailbox. That's why I wanted to consider adding a public cert.
Does that help? - please let me know if there is more you need to clarify what I'm trying to do....
When running the exchangeconnectivity analyzer for outlook anywhere (RPC) I get the following failure:
"The certificate chain didn't end in a trusted root. Root = CN=domainname.org, CN=companyweb, CN=servernamer, CN=localhost, CN=servername.XX.local"
The migration batch cannot connect to get the mailbox. That's why I wanted to consider adding a public cert.
Does that help? - please let me know if there is more you need to clarify what I'm trying to do....
I know what you are trying to do, and Microsoft have provided guidance on what you need to do. You must ensure that you are reading the correct instructions - details for a higher version of Exchange is not going to work.
You need a trusted SSL certificate in place. That usually means either buying the cheapest that they trust or testing StartCom free certificates. I cannot remember if they are trusted by Office365 though.
Simon.
You need a trusted SSL certificate in place. That usually means either buying the cheapest that they trust or testing StartCom free certificates. I cannot remember if they are trusted by Office365 though.
Simon.
ASKER
Again Simon; thank you for your help. One last question - the existing self-signed cert has other names like servername.domain.local, companyweb, etc. Will a simple certificate still do the job or do I need a UCC?
The root of their domain is pointed to the server (domainname.org); if I get a simple cert with the root domain am I covered??
AG
The root of their domain is pointed to the server (domainname.org); if I get a simple cert with the root domain am I covered??
AG
For Exchange 2003 you only need a single name certificate e.g., mail.yourdomain.com
ASKER
as I mentioned; the root is the mx; domainname.org
so I'll just get that name?
Thanks.
so I'll just get that name?
Thanks.
That should be fine.
ASKER
best I could get...worked out with 3rd party certificate. All good
Create a dummy web site on the same server, generate the CSR through that. Once you have the response then you can complete the request through that same web site.
Then on your "live" web site just run through the wizard selecting the option to replace the certificate and then picking the new one. If done with care there is almost no downtime - you just need to ensure that you have the same host name on your new certificate as the old.
Simon.