Solved

The final piece! Wildcard certificate within Exchange 2010

Posted on 2013-06-27
8
1,728 Views
Last Modified: 2013-06-29
First off...THANK YOU FOR YOUR HELP THUS FAR - YOU ARE ALL AMAZING! :D

I'm in the final stage of my new Exchange, load balanced and clustered environment. I was doing a "testexchangeconnectivity.com" check and found my new Exchange setup was failing on "Testing SSL mutual authentication with the RPC proxy server." It was attempting to use the cert for my production Exchange environment (EMAIL.domain.com) instead of the new cert (MAIL.domain.com). The actual error was:

The certificate common name email.domain.com doesn't validate against the mutual authentication string that was provided: msstd:mail.domain.com

I did some digging and found I needed to run a quick command to fix this:

set-outlookprovider  EXPR -CertPrincipalName msstd:mail.domain.com

And, at moment, everything within my new Exchange environment began to work beautifully! But, my  joy was short lived...

I found that after switching the outlook provider cert to mail.domain.com (from email.domain.com), my clients in the production environment started getting a nasty error:

 
There is a problem with the proxy server’s security certificate. The name on the security certificate is invalid or does not match the name of the target site mail.domain.com. Outlook is unable to conned to the proxy server. (Error Code 0)

Scary! D:

I immediately switched the outlook provider cert back. I need to know... Can I simply get a wildcard certificate and use that for both my mail.domain.com and email.domain.com? For example, running this command:

set-outlookprovider  EXPR -CertPrincipalName msstd:*.domain.com

How would I do this?

Thank you!!
0
Comment
Question by:jmichaelpalermo4
  • 4
  • 3
8 Comments
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39281859
If you are going to use a wildcard certificate instead of a UC (aka multiple domain) certificate then that is the command that you need to run.

Simon.
0
 
LVL 49

Accepted Solution

by:
Akhater earned 500 total points
ID: 39281876
If you are planning to use a wildcard certificate then yes you have to run
set-outlookprovider  EXPR -CertPrincipalName msstd:*.domain.com


that being said you shouldn't have such issues, the second error was most probably due to the fact that you changed the certificate on your exchange but didn't do the needed changes in tyour excchange urls
0
 
LVL 3

Author Comment

by:jmichaelpalermo4
ID: 39281883
Is it as simple as that? Are there drawbacks to doing it this way? Is there a way to successfully use both mail.domain.com and email.domain.com without going the wildcard route?

J
0
 
LVL 49

Expert Comment

by:Akhater
ID: 39281892
yes you can buy a UCC (SAN) certificate and add both URI to it that's the common way of doing it
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 
LVL 3

Author Comment

by:jmichaelpalermo4
ID: 39281902
Well, there's also another side I haven't mentioned. Currently, in production, I use a single Exchange server with CAS, HUB, and MBX, roles. When I created the CAS Array in my development domain, my production server joined the Array. When I set the URLs for each of my services ECP, OWA, Active Sync, OAB, etc. I only did it for the CAS servers in my test environment. Leaving the production server using the email.domain.com URL.

Would having a CAS server within an Array cause problems if it was using different URLs than the other Exchange servers?

J
0
 
LVL 49

Expert Comment

by:Akhater
ID: 39281942
cas array is only used for RPC connectivity it has nothing to do with the exchange URLs or the the certificate
0
 
LVL 3

Author Comment

by:jmichaelpalermo4
ID: 39281954
Do I just create a certificate for *.domain.com or add alternative DNS names to the certificate, or both?
0
 
LVL 49

Expert Comment

by:Akhater
ID: 39281959
You can't do both you need to decide on one route or another both would work
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

OfficeMate Freezes on login or does not load after login credentials are input.
Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now