Unable to replace SSL cert

I have recently replaced an expiring certificate on my Exchange 2013 server running on Server 2012 R2.  OWA shows the correct, new SSL certificate; however, Outlook is generating a warning on startup related to an expired cert meaning somehow OWA and Outlook are using different certs.  I have replaced many expiring certificates over the years, and I've never run into this issue.  Here is the process I followed:

1. Generated CSR from EAC
2. Submit .req file to 3rd party CA (Comodo)
3. Complete pending cert request in EAC using .crt file supplied by Comodo
4. Assign the IIS and SMTP services to new cert
5. Restart IIS

As I said, when viewing the certificate presented by OWA, the new, unexpired certificate is used.  Outlook continues to revert to the expired certificate for some reason.  Here are the troubleshooting steps I've tried so far:

1. Delete the expired cert completely
2. Reinstall the unexpired cert
3. verify bindings for 'Default Web Site' in IIS on port 443 are set to use the new, unexpired cert
    - Subsequently there are two bindings for port 443 which I thought was odd.  One for All Unassigned IPs (*) and another for 127.0.0.1.  Is this normal?
4. Ran an ExRCA test and verified the Outlook Anywhere test did show the new, unexpired certificate meaning this is only affecting Outlook.

Any help here would be appreciated.
LVL 2
terminalbAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

nashiookaCommented:
Forgive me but after step 3 did you import the certificate from comodo back to the machine that generated the original CSR?  If you don't do that it will be missing the private key and cause all sorts of issues.

Also, do you have more than 1 CAS server, that Outlook could potentially be speaking to?  If so you would need to export the certificate from that first machine and re-import it to any additional CAS servers.  Personally I like to use the same certificate across the global environment, so this is usually a good thing.  Of course when you generated the CSR you would have had to use the -PrivateKeyExportable parameter.
0
terminalbAuthor Commented:
You're right, I should have clarified those points.  When I reinstalled the new cert I ensured to include the private key, and this is a single Exchange server environment with a Typical installation.
0
nashiookaCommented:
Run a connection test in outlook to make sure it's connecting to the correct CAS server for all the https based services.  I know you said you only have one server, but I think give that a shot.  It's possible the Autodiscover SCP isn't set to the FQDN or other namespace DNS resolving to the CAS server?
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

terminalbAuthor Commented:
Yea I thought of that also.  Everything is connecting to the correct servers and URLs.  I can't explain it.
0
terminalbAuthor Commented:
Closing as unresolved.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
terminalbAuthor Commented:
No resolution
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.