Solved

Exchange/Outlook 2010 Security Alert - Certificates

Posted on 2013-06-20
3
3,334 Views
Last Modified: 2013-06-28
Exchange 2010 SP2 server
Windows Server 2008 R2 SP1
Outlook 2010


Hey guys and girls,

I just started seeing a certificate pop-up when users open up Outlook 2010.

Security Alert
Servername.domain.com
Information you exchange with this site cannot be viewed or changed by others. However, there is a problem with the site's security certificate.

X The application experienced an internal error loading the SSL libraries.

The site should not be trusted.

Also looking thru the Event Logs I found hundreds of the following event;

Event ID:
Schannel      36885      When asking for client authentication, this server sends a list of trusted certificate authorities to the client. The client uses this list to choose a client certificate that is trusted by the server. Currently, this server trusts so many certificate authorities that the list has grown too long. This list has thus been truncated. The administrator of this machine should review the certificate authorities trusted for client authentication and remove those that do not really need to be trusted.

Some of the googling Ive done points to a fix possibly being removing some of the 360 Certs that are listed in the 'Trusted Root Certification Authorities' MMC... but Im not sure thats the fix, also, how would I know what is used and what isnt?

Any ideas? Thanks in advance.
0
Comment
Question by:GCTTechs
  • 2
3 Comments
 
LVL 12

Accepted Solution

by:
Dave earned 500 total points
ID: 39264430
If its a server it doesn't need to trust any, other than those it uses for downloads, and those for any certs it has installed.. This KB

http://support.microsoft.com/kb/2801679

suggests deleting and then running windows update to put the missing ones back. Providing you back up the registry key its an easy change to back out....
0
 

Author Comment

by:GCTTechs
ID: 39264476
This is actually an Exchange server.
0
 
LVL 12

Expert Comment

by:Dave
ID: 39264520
Is external TLS enabled for external connections or is it just port 25? If its just port 25 its not making outbound encrypted sessions, so just the locak certs...
0

Featured Post

Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Join & Write a Comment

Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
Following basic email etiquette rules will help you write a professional email and achieve a good, lasting impression with your contacts.
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now