Solved

Exchange/Outlook 2010 Security Alert - Certificates

Posted on 2013-06-20
3
3,423 Views
Last Modified: 2013-06-28
Exchange 2010 SP2 server
Windows Server 2008 R2 SP1
Outlook 2010


Hey guys and girls,

I just started seeing a certificate pop-up when users open up Outlook 2010.

Security Alert
Servername.domain.com
Information you exchange with this site cannot be viewed or changed by others. However, there is a problem with the site's security certificate.

X The application experienced an internal error loading the SSL libraries.

The site should not be trusted.

Also looking thru the Event Logs I found hundreds of the following event;

Event ID:
Schannel      36885      When asking for client authentication, this server sends a list of trusted certificate authorities to the client. The client uses this list to choose a client certificate that is trusted by the server. Currently, this server trusts so many certificate authorities that the list has grown too long. This list has thus been truncated. The administrator of this machine should review the certificate authorities trusted for client authentication and remove those that do not really need to be trusted.

Some of the googling Ive done points to a fix possibly being removing some of the 360 Certs that are listed in the 'Trusted Root Certification Authorities' MMC... but Im not sure thats the fix, also, how would I know what is used and what isnt?

Any ideas? Thanks in advance.
0
Comment
Question by:GCTTechs
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 12

Accepted Solution

by:
Dave earned 500 total points
ID: 39264430
If its a server it doesn't need to trust any, other than those it uses for downloads, and those for any certs it has installed.. This KB

http://support.microsoft.com/kb/2801679

suggests deleting and then running windows update to put the missing ones back. Providing you back up the registry key its an easy change to back out....
0
 

Author Comment

by:GCTTechs
ID: 39264476
This is actually an Exchange server.
0
 
LVL 12

Expert Comment

by:Dave
ID: 39264520
Is external TLS enabled for external connections or is it just port 25? If its just port 25 its not making outbound encrypted sessions, so just the locak certs...
0

Featured Post

Edgartown IT Case Study

Learn about Edgartown's quest to ensure the safety and security of the entire town's employee and citizen data. Read the case study!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question