Solved

Microsoft Remote Connectivity Analyzer Pulling the wrong SSL certificate

Posted on 2013-06-24
11
713 Views
Last Modified: 2013-10-28
When I do Microsoft Remote Connectivity Analyzer Test, It appears the test is pulling a SSL certificate from our main company website and not getting the cert from our exchange server. When I launch EMC, go to Server configuration, under Exchange certificates, I see the correct certificate.

Thanks,
0
Comment
Question by:AJola
  • 2
  • 2
  • 2
  • +2
11 Comments
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 39271396
Is there some ISA or some Firewall still not updated with the new SSL cert ??

- Rancy
0
 

Author Comment

by:AJola
ID: 39271941
How do I check Randy?

What i am trying to resolve is "calender Sharing" for outside domain users. We have exchange 2010 and users are on outlook 2010.

Also attached is  auto discover test result just for more information
Autodiscover-Issue.jpg
0
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 39271972
If you have any Firewall or other app you should contact vendor to understand if it too works with Certs and how to update them

Also have you got the Autodiscover DNS record created

- Rancy
0
 

Author Comment

by:AJola
ID: 39275426
Hi Rancy Yes I have the autodiscover DNS record created.

Attached is a pic, when i do the test for Autodiscover internally inside the domain and it's successful.

My concern is when I do the autodiscover test it's pulling a SSL certificate from our main company website and not getting the cert from our exchange server.

Our main website is hosted somewhere else.

Please Help!
Autodiscover-succed.png
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 
LVL 56

Expert Comment

by:Cliff Galiher
ID: 39282308
Sounds like you have a wildcard external DNS record. That'll break autodiscover every time.  Fix hat and things should work. The remote connectivity analyzer tells younwhich DNS lookup returned the cert in its logs.
0
 
LVL 14

Expert Comment

by:Radweld
ID: 39282472
In you r example, the Autodiscover settings internally are being presented by a service connection point (SCP) this is an advertised service on a domain and not available externally. For that work the Autodiscover address must resolve to your exchange server, as the tests are retrieving a different severs details, this suggests Autodiscover isn't pointing to the correct server.
0
 
LVL 18

Accepted Solution

by:
irweazelwallis earned 500 total points
ID: 39283536
it certainly looks like creating an external autodiscover SRV record will do the trick as the testconnectivity will always look for that first. You might have to ask your ISP to set it up if you don't fully manage your own dns as most web consoles don't let you add SRV's


Service: _autodiscover
Protocol: _tcp
Port Number: 443
Host: mail.yourdomain.com
0
 
LVL 56

Expert Comment

by:Cliff Galiher
ID: 39283548
Nope. The SRV record is the LAST method used, not the first. The SRV record is a completely legitimate approach, but if other DNS or SSL certificates are misconfigured, then the certificate prompt will still appear because the other methods will trigger it before thenSRV record is even queried.
0
 
LVL 18

Expert Comment

by:irweazelwallis
ID: 39283592
yes you are right. there should be a plain A record for autodicover as well.
But it is only picking those up because there is some kind of wildcard DNS record, otherwise they would fail and the SRV record would kick in
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…
The view will learn how to download and install SIMTOOLS and FORMLIST into Excel, how to use SIMTOOLS to generate a Monte Carlo simulation of 30 sales calls, and how to calculate the conditional probability based on the results of the Monte Carlo …

930 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now