homerslmpson
asked on
Help with Exchange 2007 Certificates:
Hi all. We have 2 issues at the moment and I'm hoping someone can help.
We have an SSL UCC certificate which we use for webmail from outside the company.
The first issue is that users are now getting a security alert when launching Outlook internally.
The message is from mailserver.domain.local and it says the name on the security cert is invalid or does not match the name of the site.
The SSL cert is setup with the name webmail.domain.com
and it has the following SANs:
autodiscover.domain.com
mail.domain.com
mailserver.domain.com
I tried adding mailserver.domain.local to the SSL certificate as a SAN but it looks like I have to wait for CertificatesForExchange.co m to get back to me. Will this fix the issue?
The second issue I'm seeing is event ID 12014 in the Event Viewer.
It states that it can't find a certificate that contains the domain name mail.domain.com in the personal store.
I don't think this is causing any issues that I can see but it seems like it should be an easy fix.
Any and all help would be appreciated.
We have an SSL UCC certificate which we use for webmail from outside the company.
The first issue is that users are now getting a security alert when launching Outlook internally.
The message is from mailserver.domain.local and it says the name on the security cert is invalid or does not match the name of the site.
The SSL cert is setup with the name webmail.domain.com
and it has the following SANs:
autodiscover.domain.com
mail.domain.com
mailserver.domain.com
I tried adding mailserver.domain.local to the SSL certificate as a SAN but it looks like I have to wait for CertificatesForExchange.co
The second issue I'm seeing is event ID 12014 in the Event Viewer.
It states that it can't find a certificate that contains the domain name mail.domain.com in the personal store.
I don't think this is causing any issues that I can see but it seems like it should be an easy fix.
Any and all help would be appreciated.
ASKER
I don't understand what this means:
"you need to configure your URLs to match your external domain; don't use .local there or in your cert"
Are you trying to help me with the first issue or the second issue?
"you need to configure your URLs to match your external domain; don't use .local there or in your cert"
Are you trying to help me with the first issue or the second issue?
you need to configure autodiscover, owa...those URLs need to have the external domain (.com) not .local
you also don't use .local for the cert
the second issue, need to enable that cert for services (IIS, smpt, etc.)
Enable-ExchangeCertificate
http://technet.microsoft.com/en-us/library/aa997231%28v=exchg.80%29.aspx
you also don't use .local for the cert
the second issue, need to enable that cert for services (IIS, smpt, etc.)
Enable-ExchangeCertificate
http://technet.microsoft.com/en-us/library/aa997231%28v=exchg.80%29.aspx
ASKER
It looks like I already have the split DNS setup.
I have a Forward Lookup Zone named webmail.domain.com and have an A record pointing to the Exchange server's internal IP address.
I have a Forward Lookup Zone named webmail.domain.com and have an A record pointing to the Exchange server's internal IP address.
ok good
need to verify the exchange URLs are setup properly so that everything matches the cert
need to verify the exchange URLs are setup properly so that everything matches the cert
ASKER
where are these instructions from?
you don't want to use .local because your cert does not match that and will cause cert errors internally as you stated
you don't want to use .local because your cert does not match that and will cause cert errors internally as you stated
ASKER
I was actually following the very first link you provided.
But yeah, you mentioned everything should match the SSL cert.
If that's the case should I make the following adjustments?
autodiscover = webmail.domain.com
OAB = webmail.domain.com
OOF = webmail.domain.com
Unified Messaging (we don't use) = webmail.domain.com
But yeah, you mentioned everything should match the SSL cert.
If that's the case should I make the following adjustments?
autodiscover = webmail.domain.com
OAB = webmail.domain.com
OOF = webmail.domain.com
Unified Messaging (we don't use) = webmail.domain.com
ASKER
But that link you provided is old (Nov 2007) so I'm thinking things changed over the last few years.
it discusses using internally-created cert which is not what you want here; however the EMS commands are the same
you just put in the url of your server (the .com not .local)
scroll down to the autodiscover section for those commands
the link might be old but so is your exchange version :)
procedurally nothing has changed with that version over the years
you just put in the url of your server (the .com not .local)
scroll down to the autodiscover section for those commands
the link might be old but so is your exchange version :)
procedurally nothing has changed with that version over the years
ASKER
lol Exchange is expensive.
OK so does this make sense?
autodiscover = webmail.domain.com
OAB = webmail.domain.com
OOF = webmail.domain.com
Unified Messaging (we don't use) = webmail.domain.com
OK so does this make sense?
autodiscover = webmail.domain.com
OAB = webmail.domain.com
OOF = webmail.domain.com
Unified Messaging (we don't use) = webmail.domain.com
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I went ahead and made the changes.
I added webmail.domain.com for the internal Autodiscover, the internal OAB, the internal and external web services and I enabled Outlook Anywhere.
The error is still in the event viewer about not finding the domain name mail.domain.com in the personal store.
The image below shows the certs inside the personal store.
Some of them have the SAN of mail.domain.com while others don't.
Is there a way to see which one is being used?
I added webmail.domain.com for the internal Autodiscover, the internal OAB, the internal and external web services and I enabled Outlook Anywhere.
The error is still in the event viewer about not finding the domain name mail.domain.com in the personal store.
The image below shows the certs inside the personal store.
Some of them have the SAN of mail.domain.com while others don't.
Is there a way to see which one is being used?
ASKER
OK I've removed all of the certificates in the personal store except for the one self-signed certificate for SMTP and the SSL certificate for the other things.
After I narrowed down what self-signed certificate was being used for SMTP I ran the following command in EMC:
New-exchangecertificate -ServerName, ServerName.domain.local, mail.domain.com
The first 2 were already on the self signed certs but not the last one.
That idea was thanks to THIS link.
The error is no longer showing in the event log so I'd like to think this has been resolved.
After I narrowed down what self-signed certificate was being used for SMTP I ran the following command in EMC:
New-exchangecertificate -ServerName, ServerName.domain.local, mail.domain.com
The first 2 were already on the self signed certs but not the last one.
That idea was thanks to THIS link.
The error is no longer showing in the event log so I'd like to think this has been resolved.
ASKER
Thanks for your help.
Configuring Exchange Server 2007 Web Services URLs
http://www.msexchange.org/articles-tutorials/exchange-server-2007/management-administration/configuring-exchange-server-2007-web-services-urls.html
may also need to configure split dns
Windows - Setting Up Split DNS
http://www.petenetlive.com/KB/Article/0000830.htm