Exchange 2010 changed transport server cert, now edge sync fails

I replaced my main exchange server's certificate and now the edgesync fails.

When I do a "Start-EdgeSynchroinzation" on the hub transport server I get:

Result: CouldNotConnect
Type: Recipients
Name: EXCH2-EDGE
...
Result: CouldNotConnect
Type: Configuration
Name: EXCH2-EDGE

and the "Test-EdgeSynchronization" command Returns this:

SyncStatus: Failed
UtcNow : [a few seconds ago]
Name: EXCH2-EDGE
LeaseHolder:
FailureDetail: EdgeSync service cannot connect to this subscription because of error "No EdgeSync credentials were found for Edge Transport server. Remove the Edge subscription and re-subscribe to the Edge Transport server."
...
CredentialRecords: Number of credentials 0
CookieRecords: Number of cookies 0

Just to be clear it was the cert on the hub transport that was replaced, not the cert on the edge server.

I've removed the edge subscription from the hub transport server using EMC then went to the edge server and ran:

New-EdgeSubscription -FileName C:\Users\Administrator\Desktop\edge-subcription.xml

Then copied the file to the hub transport server and used "New Edge Subscription" in the EMC to re-add the subscription. After adding the subscription the EMC shows the EXCH2-EDGE subscription as valid under the "Is Valid" column.

However when I run the Start-EdgeSynchronization or Test-EdgeSynchronization commands (on the hub transport server) in the EMS I get the results I posted above. Given that it was the Hub transport that had it's cert replaced, it's likely that the edge server can't authenticate against the hub transport and not the other way around. Does anyone have any idea how I can fix this?
jdhwpgmbcaAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Simon Butler (Sembee)ConsultantCommented:
What did you replace the certificate with?
A trusted certificate or self signed?

In most instances, you now need two certificates on Exchange.
- A trusted certificate for web services etc.
- A self signed certificate as the default SMTP certificate for internal traffic.

Therefore the easiest fix is to run

new-exchangecertificate

on the Hub transport server, no further attributes required. When prompted to replace the default SMTP certificate say Yes. Then test again.

Simon.
1
jdhwpgmbcaAuthor Commented:
A trusted cert from comodo. I just paid $600 for it, so I'm reluctant to run new-exchangecertificate on the hub transport. That would generate a new key which would need to be re-signed by the CA. Besides, I'm not convinced that doing that is any different from generating a request and having it signed by a CA then importing the cert (in EMC). It's not that the advice isn't appreciated - but I don't want to lose my new certificate.
0
jdhwpgmbcaAuthor Commented:
I think it's likely that changing the web server certificate on the hub transport is what broke the trust between the servers. In order to re-establish the trust I have to get the edge server to refetch the ldap information containing the hub transport certificate into it's AD-LDS. I just don't know how to do this.
0
Simon Butler (Sembee)ConsultantCommented:
$600 for an SSL certificate? You can get ones suitable for Exchange for less than $70/year!
Anyway, I am not proposing replacing your trusted certificate, this is an additional SSL certificate for SMTP traffic only. New-Exchangecertificate on its own creates a new self signed certificate, which Exchange trusts.

Exchange wants to communicate with the server over SMTP using its real FQDN. However with SSL certificates that expire after November 2015 you cannot put internal names on the certificates, so you need to use a combination of trusted certificates and a self signed certificate.

Simon.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
jdhwpgmbcaAuthor Commented:
There's a bunch of Subject-Alt-Names, they say that's why it's so expensive, but I think it's a rip-off. Anyway that's off topic.

Thanks for the tip about needing two certificates, that's what did it. I generated a new cert on the hub transport using New-ExchangeCertificate. It asked me if I wanted to replace another certificate and identified the certificate as something that expired yesterday (it also showed the certs fingerprint). This was obviously not my commercial cert so I just answered yes to the prompt. After this I needed to do a "Start-EdgeSynchronization -ForceFullSync" on the hub transport. This sent the certificate to the edge server. And after this everything worked fine.

James
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.