Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Exchange/Outlook 2010 Security Alert - Certificates

Posted on 2013-06-20
3
3,404 Views
Last Modified: 2013-06-28
Exchange 2010 SP2 server
Windows Server 2008 R2 SP1
Outlook 2010


Hey guys and girls,

I just started seeing a certificate pop-up when users open up Outlook 2010.

Security Alert
Servername.domain.com
Information you exchange with this site cannot be viewed or changed by others. However, there is a problem with the site's security certificate.

X The application experienced an internal error loading the SSL libraries.

The site should not be trusted.

Also looking thru the Event Logs I found hundreds of the following event;

Event ID:
Schannel      36885      When asking for client authentication, this server sends a list of trusted certificate authorities to the client. The client uses this list to choose a client certificate that is trusted by the server. Currently, this server trusts so many certificate authorities that the list has grown too long. This list has thus been truncated. The administrator of this machine should review the certificate authorities trusted for client authentication and remove those that do not really need to be trusted.

Some of the googling Ive done points to a fix possibly being removing some of the 360 Certs that are listed in the 'Trusted Root Certification Authorities' MMC... but Im not sure thats the fix, also, how would I know what is used and what isnt?

Any ideas? Thanks in advance.
0
Comment
Question by:GCTTechs
  • 2
3 Comments
 
LVL 12

Accepted Solution

by:
Dave earned 500 total points
ID: 39264430
If its a server it doesn't need to trust any, other than those it uses for downloads, and those for any certs it has installed.. This KB

http://support.microsoft.com/kb/2801679

suggests deleting and then running windows update to put the missing ones back. Providing you back up the registry key its an easy change to back out....
0
 

Author Comment

by:GCTTechs
ID: 39264476
This is actually an Exchange server.
0
 
LVL 12

Expert Comment

by:Dave
ID: 39264520
Is external TLS enabled for external connections or is it just port 25? If its just port 25 its not making outbound encrypted sessions, so just the locak certs...
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Read this checklist to learn more about the 15 things you should never include in an email signature.
This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question