?
Solved

SBS 2003 Migration to Office 365 certificate challenges

Posted on 2013-06-17
12
Medium Priority
?
1,133 Views
Last Modified: 2013-11-06
Hi there,

We are having a challenge I'm hoping the community can help with:

Working to do a staged batch migration from SBS 2003 to Office 365. The migration tools will not connect as there isn't a 3rd party certificate in place...only the self-signed.

Question: Can we add a simple public CA certificate to the existing server in ADDITION to the in-place self-signed one? There are numerous remote stations connecting with RPC/HTTP and we do not want to break that process. We have not found any specific resources for adding another third party certificate (autodiscover.domainame.xxx) to IIS for this purpose. Is it possible and can you offer any direction?

In trying to create the CSR - the only option is to manipulate the self-signed; again we need to protect the integrity of RPC/http as it is now.

All mailboxes are moving; no federation - this is for a non-profit so resources are scarce :-)

Thank you in advance for your thoughts.

AG
0
Comment
Question by:agolub
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
  • 3
12 Comments
 
LVL 76

Assisted Solution

by:Alan Hardisty
Alan Hardisty earned 1500 total points
ID: 39255408
No - you will need to replace the existing self-signed certificate.

IIS will only work with one certificate on the default website.

As long as you go with a cert such as GoDaddy / Starfield or another that is well known and trusted by the client, then there should be no issues with RPC over HTTPS breaking or needing to install certificates on the client unless they are vastly out of date update-wise.

To generate a new CSR, you will need to remove the existing SSL certificate and wait for the new one to be approved, so there will be some time where clients can't connect, so you need to time that part right to minimise the impact.

I always use a Starfield cert (GoDaddy Reseller) for $30 and it works like a charm.

Alan
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39255465
You can get round the web site issue very easily though.
Create a dummy web site on the same server, generate the CSR through that. Once you have the response then you can complete the request through that same web site.
Then on your "live" web site just run through the wizard selecting the option to replace the certificate and then picking the new one. If done with care there is almost no downtime - you just need to ensure that you have the same host name on your new certificate as the old.

Simon.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 39255508
Good plan Simon.  Not thought of doing it that way before.

Alan
0
Cyber Threats to Small Businesses (Part 1)

This past May, Webroot surveyed more than 600 IT decision-makers at medium-sized companies to see how these small businesses perceived new threats facing their organizations.  Read what Webroot CISO, Gary Hayslip, has to say about the survey in part 1 of this 2-part blog series.

 

Accepted Solution

by:
agolub earned 0 total points
ID: 39256232
Thanks so much for your input!

Simon; just to be clear; I go into IIS and create a new site outside the "default" where OWA and RPC live; generate the CSR and process the request. Once the cert is ready, replace the existing via the wizard in SBS....

The tech who set this up has the root of the domain (public) pointed to the server public IP; Do I need to use a simple cert or a UCC? Can I get away with "autodiscover.domainname.xxx? Or should I do it for the root as it is now?

As for RPC - won't the clients get an error and have to have the certificate replaced?

Again; thank you for your help!!
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39257058
SBS 2003 doesn't support Autodiscover, so putting autodiscover in the certificate isn't going to help.
As long as you get the certificate for the same host name that the clients are currently using, they will not get an error.

Simon.
0
 

Author Comment

by:agolub
ID: 39257150
I understand; remember, the purpose for doing this is to get O365 to talk to the exchange server for the purpose of migration. I need to know what will make that work as it should. I can put "autodiscover" in if that allows it to connect and get mailboxes moving if needed.

When running the exchangeconnectivity analyzer for outlook anywhere (RPC) I get the following failure:
"The certificate chain didn't end in a trusted root. Root = CN=domainname.org, CN=companyweb, CN=servernamer, CN=localhost, CN=servername.XX.local"

The migration batch cannot connect to get the mailbox. That's why I wanted to consider adding a public cert.

Does that help? - please let me know if there is more you need to clarify what I'm trying to do....
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39259195
I know what you are trying to do, and Microsoft have provided guidance on what you need to do. You must ensure that you are reading the correct instructions - details for a higher version of Exchange is not going to work.

You need a trusted SSL certificate in place. That usually means either buying the cheapest that they trust or testing StartCom free certificates. I cannot remember if they are trusted by Office365 though.

Simon.
0
 

Author Comment

by:agolub
ID: 39263559
Again Simon; thank you for your help. One last question - the existing self-signed cert has other names like servername.domain.local, companyweb, etc. Will a simple certificate still do the job or do I need a UCC?

The root of their domain is pointed to the server (domainname.org); if I get a simple cert with the root domain am I covered??

AG
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 39264158
For Exchange 2003 you only need a single name certificate e.g., mail.yourdomain.com
0
 

Author Comment

by:agolub
ID: 39264176
as I mentioned; the root is the mx; domainname.org

so I'll just get that name?

Thanks.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 39264184
That should be fine.
0
 

Author Closing Comment

by:agolub
ID: 39626869
best I could get...worked out with 3rd party certificate. All good
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
Unified and professional email signatures help maintain a consistent company brand image to the outside world. This article shows how to create an email signature in Exchange Server 2010 using a transport rule and how to overcome native limitations …
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Need to grow your business through quality cloud solutions? With everything required to build a cloud platform and solution, you may feel like the distance between you and the cloud is quite long. Help is here. Spend some time learning about the Con…
Suggested Courses
Course of the Month13 days, 6 hours left to enroll

801 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question