Solved

Help with Exchange 2007 Certificates:

Posted on 2014-10-14
15
139 Views
Last Modified: 2014-10-16
Hi all. We have 2 issues at the moment and I'm hoping someone can help.
We have an SSL UCC certificate which we use for webmail from outside the company.
The first issue is that users are now getting a security alert when launching Outlook internally.
The message is from mailserver.domain.local and it says the name on the security cert is invalid or does not match the name of the site.
The SSL cert is setup with the name webmail.domain.com
and it has the following SANs:
autodiscover.domain.com
mail.domain.com
mailserver.domain.com

I tried adding mailserver.domain.local to the SSL certificate as a SAN but it looks like I have to wait for CertificatesForExchange.com to get back to me.  Will this fix the issue?  

The second issue I'm seeing is event ID 12014 in the Event Viewer.
It states that it can't find a certificate that contains the domain name mail.domain.com in the personal store.

I don't think this is causing any issues that I can see but it seems like it should be an easy fix.

Any and all help would be appreciated.
0
Comment
Question by:homerslmpson
  • 9
  • 6
15 Comments
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 40379766
you need to configure your URLs to match your external domain; don't use .local there or in your cert

Configuring Exchange Server 2007 Web Services URLs
http://www.msexchange.org/articles-tutorials/exchange-server-2007/management-administration/configuring-exchange-server-2007-web-services-urls.html

may also need to configure split dns

Windows - Setting Up Split DNS
http://www.petenetlive.com/KB/Article/0000830.htm
0
 
LVL 1

Author Comment

by:homerslmpson
ID: 40379775
I don't understand what this means:
"you need to configure your URLs to match your external domain; don't use .local there or in your cert"

Are you trying to help me with the first issue or the second issue?
0
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 40379884
you need to configure autodiscover, owa...those URLs need to have the external domain (.com) not .local
you also don't use .local for the cert

the second issue, need to enable that cert for services (IIS, smpt, etc.)

Enable-ExchangeCertificate
http://technet.microsoft.com/en-us/library/aa997231%28v=exchg.80%29.aspx
0
 
LVL 1

Author Comment

by:homerslmpson
ID: 40379901
It looks like I already have the split DNS setup.
I have a Forward Lookup Zone named webmail.domain.com and have an A record pointing to the Exchange server's internal IP address.
0
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 40379920
ok good
need to verify the exchange URLs are setup properly so that everything matches the cert
0
 
LVL 1

Author Comment

by:homerslmpson
ID: 40380497
Should I use webmail.domain.local for the internal URL or mail.domain.local?
The instructions mention using mail.domain.local but as I mentioned earlier the forward lookup zone and SSL cert use the name webmail.domain.com.
mail.domain.com
0
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 40380517
where are these instructions from?
you don't want to use .local because your cert does not match that and will cause cert errors internally as you stated
0
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

 
LVL 1

Author Comment

by:homerslmpson
ID: 40380528
I was actually following the very first link you provided.

But yeah, you mentioned everything should match the SSL cert.
If that's the case should I make the following adjustments?

autodiscover = webmail.domain.com
OAB = webmail.domain.com
OOF = webmail.domain.com
Unified Messaging (we don't use) = webmail.domain.com
0
 
LVL 1

Author Comment

by:homerslmpson
ID: 40380532
But that link you provided is old (Nov 2007) so I'm thinking things changed over the last few years.
0
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 40380571
it discusses using internally-created cert which is not what you want here; however the EMS commands are the same
you just put in the url of your server (the .com not .local)
scroll down to the autodiscover section for those commands

the link might be old but so is your exchange version :)
procedurally nothing has changed with that version over the years
0
 
LVL 1

Author Comment

by:homerslmpson
ID: 40380582
lol Exchange is expensive.
OK so does this make sense?
autodiscover = webmail.domain.com
OAB = webmail.domain.com
OOF = webmail.domain.com
Unified Messaging (we don't use) = webmail.domain.com
0
 
LVL 34

Accepted Solution

by:
Seth Simmons earned 500 total points
ID: 40380617
yes it can be as long as DNS records are there and the name is on the cert (which you have)

here is the technet article i was looking for
a bit simpler to read

How to Configure Exchange Services for the Autodiscover Service
http://technet.microsoft.com/en-us/library/bb201695%28EXCHG.80%29.aspx
0
 
LVL 1

Author Comment

by:homerslmpson
ID: 40382420
I went ahead and made the changes.
I added webmail.domain.com for the internal Autodiscover, the internal OAB, the internal and external web services and I enabled Outlook Anywhere.
The error is still in the event viewer about not finding the domain name mail.domain.com in the personal store.
The image below shows the certs inside the personal store.
Some of them have the SAN of mail.domain.com while others don't.
Is there a way to see which one is being used?
personal store
0
 
LVL 1

Author Comment

by:homerslmpson
ID: 40384727
OK I've removed all of the certificates in the personal store except for the one self-signed certificate for SMTP and the SSL certificate for the other things.
After I narrowed down what self-signed certificate was being used for SMTP I ran the following command in EMC:
New-exchangecertificate -ServerName, ServerName.domain.local, mail.domain.com
The first 2 were already on the self signed certs but not the last one.
That idea was thanks to THIS link.
The error is no longer showing in the event log so I'd like to think this has been resolved.
0
 
LVL 1

Author Closing Comment

by:homerslmpson
ID: 40384730
Thanks for your help.
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process describes the steps required to Import and Export data from and to .pst files using Exchange 2010. We can use these steps to export data from a user to a .pst file, import data back to the same or a different user, or even import data t…
Find out what you should include to make the best professional email signature for your organization.
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now