Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

The final piece! Wildcard certificate within Exchange 2010

Posted on 2013-06-27
8
Medium Priority
?
1,927 Views
Last Modified: 2013-06-29
First off...THANK YOU FOR YOUR HELP THUS FAR - YOU ARE ALL AMAZING! :D

I'm in the final stage of my new Exchange, load balanced and clustered environment. I was doing a "testexchangeconnectivity.com" check and found my new Exchange setup was failing on "Testing SSL mutual authentication with the RPC proxy server." It was attempting to use the cert for my production Exchange environment (EMAIL.domain.com) instead of the new cert (MAIL.domain.com). The actual error was:

The certificate common name email.domain.com doesn't validate against the mutual authentication string that was provided: msstd:mail.domain.com

I did some digging and found I needed to run a quick command to fix this:

set-outlookprovider  EXPR -CertPrincipalName msstd:mail.domain.com

And, at moment, everything within my new Exchange environment began to work beautifully! But, my  joy was short lived...

I found that after switching the outlook provider cert to mail.domain.com (from email.domain.com), my clients in the production environment started getting a nasty error:

 
There is a problem with the proxy server’s security certificate. The name on the security certificate is invalid or does not match the name of the target site mail.domain.com. Outlook is unable to conned to the proxy server. (Error Code 0)

Scary! D:

I immediately switched the outlook provider cert back. I need to know... Can I simply get a wildcard certificate and use that for both my mail.domain.com and email.domain.com? For example, running this command:

set-outlookprovider  EXPR -CertPrincipalName msstd:*.domain.com

How would I do this?

Thank you!!
0
Comment
Question by:jmichaelpalermo4
  • 4
  • 3
8 Comments
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39281859
If you are going to use a wildcard certificate instead of a UC (aka multiple domain) certificate then that is the command that you need to run.

Simon.
0
 
LVL 49

Accepted Solution

by:
Akhater earned 2000 total points
ID: 39281876
If you are planning to use a wildcard certificate then yes you have to run
set-outlookprovider  EXPR -CertPrincipalName msstd:*.domain.com


that being said you shouldn't have such issues, the second error was most probably due to the fact that you changed the certificate on your exchange but didn't do the needed changes in tyour excchange urls
0
 
LVL 3

Author Comment

by:jmichaelpalermo4
ID: 39281883
Is it as simple as that? Are there drawbacks to doing it this way? Is there a way to successfully use both mail.domain.com and email.domain.com without going the wildcard route?

J
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 
LVL 49

Expert Comment

by:Akhater
ID: 39281892
yes you can buy a UCC (SAN) certificate and add both URI to it that's the common way of doing it
0
 
LVL 3

Author Comment

by:jmichaelpalermo4
ID: 39281902
Well, there's also another side I haven't mentioned. Currently, in production, I use a single Exchange server with CAS, HUB, and MBX, roles. When I created the CAS Array in my development domain, my production server joined the Array. When I set the URLs for each of my services ECP, OWA, Active Sync, OAB, etc. I only did it for the CAS servers in my test environment. Leaving the production server using the email.domain.com URL.

Would having a CAS server within an Array cause problems if it was using different URLs than the other Exchange servers?

J
0
 
LVL 49

Expert Comment

by:Akhater
ID: 39281942
cas array is only used for RPC connectivity it has nothing to do with the exchange URLs or the the certificate
0
 
LVL 3

Author Comment

by:jmichaelpalermo4
ID: 39281954
Do I just create a certificate for *.domain.com or add alternative DNS names to the certificate, or both?
0
 
LVL 49

Expert Comment

by:Akhater
ID: 39281959
You can't do both you need to decide on one route or another both would work
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this post, we will learn to set up the Group Naming policy and will see how it is going to impact the Display Name and the Email addresses of the Group.
In my humble opinion (IMHO), TouchDown from Symantec is the best in class for this type of application, but Symantec has end-of-lifed it and although one can keep using it, it will no longer be supported or upgraded.  Time to look for alternatives t…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
how to add IIS SMTP to handle application/Scanner relays into office 365.
Suggested Courses

581 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question