Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Unable to replace SSL cert

Posted on 2014-12-06
6
Medium Priority
?
94 Views
Last Modified: 2015-01-03
I have recently replaced an expiring certificate on my Exchange 2013 server running on Server 2012 R2.  OWA shows the correct, new SSL certificate; however, Outlook is generating a warning on startup related to an expired cert meaning somehow OWA and Outlook are using different certs.  I have replaced many expiring certificates over the years, and I've never run into this issue.  Here is the process I followed:

1. Generated CSR from EAC
2. Submit .req file to 3rd party CA (Comodo)
3. Complete pending cert request in EAC using .crt file supplied by Comodo
4. Assign the IIS and SMTP services to new cert
5. Restart IIS

As I said, when viewing the certificate presented by OWA, the new, unexpired certificate is used.  Outlook continues to revert to the expired certificate for some reason.  Here are the troubleshooting steps I've tried so far:

1. Delete the expired cert completely
2. Reinstall the unexpired cert
3. verify bindings for 'Default Web Site' in IIS on port 443 are set to use the new, unexpired cert
    - Subsequently there are two bindings for port 443 which I thought was odd.  One for All Unassigned IPs (*) and another for 127.0.0.1.  Is this normal?
4. Ran an ExRCA test and verified the Outlook Anywhere test did show the new, unexpired certificate meaning this is only affecting Outlook.

Any help here would be appreciated.
0
Comment
Question by:terminalb
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
6 Comments
 
LVL 10

Expert Comment

by:nashiooka
ID: 40485426
Forgive me but after step 3 did you import the certificate from comodo back to the machine that generated the original CSR?  If you don't do that it will be missing the private key and cause all sorts of issues.

Also, do you have more than 1 CAS server, that Outlook could potentially be speaking to?  If so you would need to export the certificate from that first machine and re-import it to any additional CAS servers.  Personally I like to use the same certificate across the global environment, so this is usually a good thing.  Of course when you generated the CSR you would have had to use the -PrivateKeyExportable parameter.
0
 
LVL 2

Author Comment

by:terminalb
ID: 40486809
You're right, I should have clarified those points.  When I reinstalled the new cert I ensured to include the private key, and this is a single Exchange server environment with a Typical installation.
0
 
LVL 10

Expert Comment

by:nashiooka
ID: 40497340
Run a connection test in outlook to make sure it's connecting to the correct CAS server for all the https based services.  I know you said you only have one server, but I think give that a shot.  It's possible the Autodiscover SCP isn't set to the FQDN or other namespace DNS resolving to the CAS server?
0
Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

 
LVL 2

Author Comment

by:terminalb
ID: 40501168
Yea I thought of that also.  Everything is connecting to the correct servers and URLs.  I can't explain it.
0
 
LVL 2

Accepted Solution

by:
terminalb earned 0 total points
ID: 40522730
Closing as unresolved.
0
 
LVL 2

Author Closing Comment

by:terminalb
ID: 40528909
No resolution
0

Featured Post

New benefit for Premium Members - Upgrade now!

Ready to get started with anonymous questions today? It's easy! Learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you troubleshoot Outlook for clients, you may want to know a bit more about the OST file before doing your next job. IMAP can cause a lot of drama if removed in the accounts without backing up.
Know the reasons and solutions to move/import EDB to New Exchange Server. Also, find out how to recover an Exchange .edb file and to restore the file back.
Many of my clients call in with monstrous Gmail overloading issues with Outlook. A quick tip is to turn off the All Mail and Important folders from synching. Here is a quick video I made to show you how to turn off these and other folders in Gmail s…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question