Solved

The final piece! Wildcard certificate within Exchange 2010

Posted on 2013-06-27
8
1,756 Views
Last Modified: 2013-06-29
First off...THANK YOU FOR YOUR HELP THUS FAR - YOU ARE ALL AMAZING! :D

I'm in the final stage of my new Exchange, load balanced and clustered environment. I was doing a "testexchangeconnectivity.com" check and found my new Exchange setup was failing on "Testing SSL mutual authentication with the RPC proxy server." It was attempting to use the cert for my production Exchange environment (EMAIL.domain.com) instead of the new cert (MAIL.domain.com). The actual error was:

The certificate common name email.domain.com doesn't validate against the mutual authentication string that was provided: msstd:mail.domain.com

I did some digging and found I needed to run a quick command to fix this:

set-outlookprovider  EXPR -CertPrincipalName msstd:mail.domain.com

And, at moment, everything within my new Exchange environment began to work beautifully! But, my  joy was short lived...

I found that after switching the outlook provider cert to mail.domain.com (from email.domain.com), my clients in the production environment started getting a nasty error:

 
There is a problem with the proxy server’s security certificate. The name on the security certificate is invalid or does not match the name of the target site mail.domain.com. Outlook is unable to conned to the proxy server. (Error Code 0)

Scary! D:

I immediately switched the outlook provider cert back. I need to know... Can I simply get a wildcard certificate and use that for both my mail.domain.com and email.domain.com? For example, running this command:

set-outlookprovider  EXPR -CertPrincipalName msstd:*.domain.com

How would I do this?

Thank you!!
0
Comment
Question by:jmichaelpalermo4
  • 4
  • 3
8 Comments
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39281859
If you are going to use a wildcard certificate instead of a UC (aka multiple domain) certificate then that is the command that you need to run.

Simon.
0
 
LVL 49

Accepted Solution

by:
Akhater earned 500 total points
ID: 39281876
If you are planning to use a wildcard certificate then yes you have to run
set-outlookprovider  EXPR -CertPrincipalName msstd:*.domain.com


that being said you shouldn't have such issues, the second error was most probably due to the fact that you changed the certificate on your exchange but didn't do the needed changes in tyour excchange urls
0
 
LVL 3

Author Comment

by:jmichaelpalermo4
ID: 39281883
Is it as simple as that? Are there drawbacks to doing it this way? Is there a way to successfully use both mail.domain.com and email.domain.com without going the wildcard route?

J
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 
LVL 49

Expert Comment

by:Akhater
ID: 39281892
yes you can buy a UCC (SAN) certificate and add both URI to it that's the common way of doing it
0
 
LVL 3

Author Comment

by:jmichaelpalermo4
ID: 39281902
Well, there's also another side I haven't mentioned. Currently, in production, I use a single Exchange server with CAS, HUB, and MBX, roles. When I created the CAS Array in my development domain, my production server joined the Array. When I set the URLs for each of my services ECP, OWA, Active Sync, OAB, etc. I only did it for the CAS servers in my test environment. Leaving the production server using the email.domain.com URL.

Would having a CAS server within an Array cause problems if it was using different URLs than the other Exchange servers?

J
0
 
LVL 49

Expert Comment

by:Akhater
ID: 39281942
cas array is only used for RPC connectivity it has nothing to do with the exchange URLs or the the certificate
0
 
LVL 3

Author Comment

by:jmichaelpalermo4
ID: 39281954
Do I just create a certificate for *.domain.com or add alternative DNS names to the certificate, or both?
0
 
LVL 49

Expert Comment

by:Akhater
ID: 39281959
You can't do both you need to decide on one route or another both would work
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question