Solved

Exchange 2013 FQDN Certificate Error

Posted on 2014-11-06
7
319 Views
Last Modified: 2014-11-20
Hello weve put mail.ville.xxx.qc.ca for the FQDN of the Default Frontend NAMESERVER but im not sure if it's ok

Because we use TMG and we use owa.ville.xxx.qc.ca for OWA

mail.ville.xxx.qc.ca is a nat to our exchange server directly

we are receiving this error

Microsoft Exchange could not find a certificate that contains the domain name mail.ville.xxx.qc.ca in the personal store on the local computer. Therefore, it is unable to support the STARTTLS SMTP verb for the connector Default Frontend NAMESERVER with a FQDN parameter of mail.ville.xxx.qc.ca. If the connector's FQDN is not specified, the computer's FQDN is used. Verify the connector configuration and the installed certificates to make sure that there is a certificate with a domain name for that FQDN. If this certificate exists, run Enable-ExchangeCertificate -Services SMTP to make sure that the Microsoft Exchange Transport service has access to the certificate key.

What FQDN i should use ?

If mail.ville.xxx.qc.ca is ok how to add it to the certificate

Thanks !
0
Comment
Question by:jfguenet
  • 4
  • 3
7 Comments
 
LVL 19

Expert Comment

by:Adam Farage
ID: 40426315
Run the following:

Get-ExchangeCertificate | FL

Let us know the output. Most likely what has occurred is that you should change the FQDN of the send connector to something that is common on the certificate. That should resolve the issue.

Also.. I don't think TMG plays into this as you most likely do not have a web rule for it.
0
 

Author Comment

by:jfguenet
ID: 40426462
[PS] C:\Windows\system32>Get-ExchangeCertificate | FL


AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule,
                     System.Security.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {owa.xxx.xxx.qc.ca, www.owa.xxx.xxx.qc.ca}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/,
                     O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US
NotAfter           : 2015-10-01 07:13:26
NotBefore          : 2014-09-23 13:35:19
PublicKeySize      : 2048
RootCAType         : ThirdParty
SerialNumber       : 2B503D0F61C656
Services           : None
Status             : Valid
Subject            : CN=owa.xxx.xxx.qc.ca, OU=Domain Control Validated
Thumbprint         : 62821EE9FFC4C0FF41AA86E1A9A8DDC9BC6688ED

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule,
                     System.Security.AccessControl.CryptoKeyAccessRule,
                     System.Security.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {server_name.xxx.xxx.qc.ca, AutoDiscover.xxx.xxx.qc.ca,
                     AutoDiscover.xxx.ca, server_name, xxx.xxx.qc.ca, xxx.ca}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=AC-Racine, DC=ville, DC=xxx, DC=qc, DC=ca
NotAfter           : 2016-09-15 15:47:43
NotBefore          : 2014-09-16 15:47:43
PublicKeySize      : 2048
RootCAType         : Enterprise
SerialNumber       : 535F5FB8000000000679
Services           : IMAP, POP, SMTP
Status             : Valid
Subject            : CN=server_name.xxx.xxx.qc.ca, OU=TI, O=xxx, L=xxx, S=QC, C=CA
Thumbprint         : 0D911213DE4A8B565F185A8E3E28AF5B80AC5893

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule,
                     System.Security.AccessControl.CryptoKeyAccessRule,
                     System.Security.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {owa.xxx.xxx.qc.ca, server_name.xxx.xxx.qc.ca,
                     AutoDiscover.xxx.xxx.qc.ca, AutoDiscover.xxx.ca, server_name,
                     xxx.xxx.qc.ca, xxx.ca}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=AC-Racine, DC=ville, DC=xxx, DC=qc, DC=ca
NotAfter           : 2016-09-15 13:23:11
NotBefore          : 2014-09-16 13:23:11
PublicKeySize      : 2048
RootCAType         : Enterprise
SerialNumber       : 52DB0EDA000000000678
Services           : IMAP, POP, IIS, SMTP
Status             : Valid
Subject            : CN=owa.xxx.xxx.qc.ca, OU=TI, O=xxx, L=xxx, S=Québec, C=CA
Thumbprint         : 867EAB32807A54ACEFF53BF0850434FED0DAC903
0
 
LVL 19

Expert Comment

by:Adam Farage
ID: 40426475
Change the EHLO name to match the OWA namespace on the certificate and this will fix the STARTTLS issue. If you do not want that namespace there, then you would need a certificate that has the mail.xxx.xxx.xxx.com namespace.
0
Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 

Author Comment

by:jfguenet
ID: 40426595
if i put owa.xxx.qc.ca it's not the same public ip address as mail.xxx.qc.ca

owa is for my TMG server
mail is for my exchange server

The EHLO name must me mail no ?

Will i have problem if i put owa ?
0
 
LVL 19

Expert Comment

by:Adam Farage
ID: 40426640
You should not have an issue putting OWA. The name has to be listed on the SSL certificate. I would increase SMTP logging like you did before and check again, but it should resolve your issue.
0
 

Author Comment

by:jfguenet
ID: 40426844
And if i put the server name instead is it better ?
0
 
LVL 19

Accepted Solution

by:
Adam Farage earned 500 total points
ID: 40427009
The context of the EHLO FQDN must match the Certificate Domains if you would like TLS to work. I would recommend either rekeying the certificate (since you missed AutoDiscover anyways) and keep the name or change the EHLO FQDN to what is listed on your certificate.
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

778 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question