Exchange 2010 Certificate Expired, New rules prevent just renewing. What do I do now?

So after running great for the last 3 years my Exchange server certificate is expired.
I generated a renewal CSR only to find out that now local DNS names are not acceptable under the new SSL rules.
We use Godaddy for our UCC SSL and now I am not sure how I go about converting the names so that I do not need internal names.
We connect to Exchange internally for the most part but use the SSLs to secure our email in and out of the premises.

So how do we get away from using names like ServerE10.AX.local for Exchange?
LVL 1
rodneygrayAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Will SzymkowskiSenior Solution ArchitectCommented:
You need to configure Split DNS on your internal DNS servers. The certificate need to have mail.domain.com and autodiscover.domain.com (thats it). You would then configure your interl URL's to point.

I have created a HowTo and illustrated configuring Split DNS, installing and enabling the Exchange certificate, and also updating the virtual directories.

The screenshots are illustrating using Exchange 2013 but the process for Enabling the Exchange certificate, split dns and updating the internal virtual directories are the same.

Configure Split DNS and Virtual Directories
http://www.wsit.ca/how-tos/exchange-server-2/configure-split-dns-and-exchange-2013-virtual-directories/

Enable the Exchange Certificate (it is the second half of the HowTo)
http://www.wsit.ca/how-tos/exchange-server-2/exchange-2013-certificate-generation-csr-import-enable-exchange-certificate/

Will.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
AmitIT ArchitectCommented:
You need to update all Exchange service like OWA, Active sync etc. I found this KB, which have all details.

https://blog.digicert.com/exchange-replacing-internal-names-certificates-part-2/
0
ChrisCommented:
its good practise to have the external domain names set on the exchange url's as shown in the post above
the other option and also a general good practise to have some kind of reverse proxy presenting the external services which means you can use an internal CA for internal users and external certificates on a reverse proxy for external connections
0
MAS (MVE)EE Solution GuideCommented:
You need only 2 names in your certificate if you have only one domain.
i.e. mail.emaildomain.com and autodiscover.emaildomain.com
Please check my article which will help you to configure URLs and configure pinpoint DNS to resolve external name from internal network
http://www.experts-exchange.com/articles/13676/Out-Of-office-not-working.html
0
rodneygrayAuthor Commented:
A few steps were missing to use this guide for 2010 such as gong in and assigning the certificate to services via the Exchange Console and a few commands did not work toward the end because they were Exchange 2013 specif.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.