- Exchange
- SSL / HTTPS
- Windows Server 2008
- Microsoft IIS Web Server
Exchange Default Self Signed Certificates
Hello All,
I have my exchange 2019 server setup and working fine for passing mail. OWA and the wildcard cert I have works fine for OWA, mail clients, etc. No problems with normal mail flow, or utilizing the wildcard cert I purchased from Sectigo RSA Domain Validation Secure Server .
I do have an issue when attempting to telnet into Exchange using openssl in order to run starttls. I am able to get connected via openssl and I am passed a certificate from the exchange server, BUT it is not the certificate I am expecting. Instead of getting the wildcard certificate from Sectigo RSA Domain Validation Secure Server , I am getting a self signed certifcate. Which is why I believe my Ehlo after starttls fals with '501 5.5.4 Invalid domain name'.
Looking at EAC I have four certificates total
Name: Microsoft Exchange, self signed certificate, assigned services: SMTP
Name: Microsoft Exchange Server Auth Certificate, self-signed certificate, assigned to services SMTP
Name: Wild, Sectigo RSA Domain Validation Secure Server, assigned services IMAP, POP, IIS, SMTP
Name: WMSVC-SHA2, self-signed certificate, assigned to services SMTP.
Can I remove any of the self-signed certificates?
Is there a way to specify when using openssl to specify which certificate it should use?
my understanding is IIS needs the WMSVC-SHA2 cert....
I have my exchange 2019 server setup and working fine for passing mail. OWA and the wildcard cert I have works fine for OWA, mail clients, etc. No problems with normal mail flow, or utilizing the wildcard cert I purchased from Sectigo RSA Domain Validation Secure Server .
I do have an issue when attempting to telnet into Exchange using openssl in order to run starttls. I am able to get connected via openssl and I am passed a certificate from the exchange server, BUT it is not the certificate I am expecting. Instead of getting the wildcard certificate from Sectigo RSA Domain Validation Secure Server , I am getting a self signed certifcate. Which is why I believe my Ehlo after starttls fals with '501 5.5.4 Invalid domain name'.
Looking at EAC I have four certificates total
Name: Microsoft Exchange, self signed certificate, assigned services: SMTP
Name: Microsoft Exchange Server Auth Certificate, self-signed certificate, assigned to services SMTP
Name: Wild, Sectigo RSA Domain Validation Secure Server, assigned services IMAP, POP, IIS, SMTP
Name: WMSVC-SHA2, self-signed certificate, assigned to services SMTP.
Can I remove any of the self-signed certificates?
Is there a way to specify when using openssl to specify which certificate it should use?
my understanding is IIS needs the WMSVC-SHA2 cert....
Hi there,
To keep it short, you need them certificates, otherwise exchange OWA/ECP, etc.. it won't work.
That's because you do not need wildcard for exchange, you need to expedite the SAN certificate once more and redeploy it.
You need two domains.
Mail.domain.com
autodiscover.domain.com
If you use wildcard whenever you type your domain you're not telling specifically to exchange what domain name to look for.
To keep it short, you need them certificates, otherwise exchange OWA/ECP, etc.. it won't work.
That's because you do not need wildcard for exchange, you need to expedite the SAN certificate once more and redeploy it.
You need two domains.
Mail.domain.com
autodiscover.domain.com
If you use wildcard whenever you type your domain you're not telling specifically to exchange what domain name to look for.
Thanks Hemil,
So what I should do is get a SAN that specifies the full FQDNs? I accept mail for two domains (domain1 & domain2), with domain1 slated to be retired. If I unerstand correctly my SAN cert would look like this for now?
In the certificate I would need to include the following:
mail.domain1.com
mail.domain2.com
autodiscover.domain2.com
Once that certificate is in place, and I openssl (for starttls), it will know which certificate to pass me, and stop sending me the self signed cert?
Do you suspect this is why I can't EHLO after starttls?
So what I should do is get a SAN that specifies the full FQDNs? I accept mail for two domains (domain1 & domain2), with domain1 slated to be retired. If I unerstand correctly my SAN cert would look like this for now?
In the certificate I would need to include the following:
mail.domain1.com
mail.domain2.com
autodiscover.domain2.com
Once that certificate is in place, and I openssl (for starttls), it will know which certificate to pass me, and stop sending me the self signed cert?
Do you suspect this is why I can't EHLO after starttls?
Hi, Yes, you need to get a SAN. If you are working with two Exchange servers you can add mail2 as well. So it will look like this
mail.domain1.com
mail.domain2.com
autodiscover.domain1.com
autodiscover.domain2.com
Yes, why? simple, you are starting a TLS communication which is the successor of SSL. If you do not have the certificate in place it wont work. SSL depends on your IIS all the time, in fact, exchange depends on it.
Something you can do is work plain text with EHLO on port 25, that will work because you aren't starting a TLS communication.
Does that make sense?
mail.domain1.com
mail.domain2.com
autodiscover.domain1.com
autodiscover.domain2.com
Do you suspect this is why I can't EHLO after starttls?
Yes, why? simple, you are starting a TLS communication which is the successor of SSL. If you do not have the certificate in place it wont work. SSL depends on your IIS all the time, in fact, exchange depends on it.
Something you can do is work plain text with EHLO on port 25, that will work because you aren't starting a TLS communication.
Does that make sense?
yup that makes sense. We can successfully telnet to the mail server with plain text, ehlo, auth login, and send mail. It is only an issue when we attempt to STARTTLS.
This started by setting up a fax server (fax to email) and creating it's own receive connector. It works on plain text, but when attempting to use TLS it fails once it issues the STARTTLS command. We started testing with OpenSSL to see exactly why, and we are failing at the same point.
This started by setting up a fax server (fax to email) and creating it's own receive connector. It works on plain text, but when attempting to use TLS it fails once it issues the STARTTLS command. We started testing with OpenSSL to see exactly why, and we are failing at the same point.
Dude, just make it simple, leave it plain text and allow only the fax server to relay. It is only for receiving not sending.
haha, yeah you're right! But, now I have an itch to make it work, and for any future uses (whatever they may be).
Right now it is setup and working plain text, with the receive connector scoped for only it's IP address.
We previously used SAN, but that was when we controlled the DNS records. Now we are a subdomain of a larger organization, and they control the DNS records. I can only do CV validation certificate, so I have to rely on their DNS admins to make the record and the validation to go through, not that big a deal, but still a PIA.
Thanks for the help, and explanation.
Right now it is setup and working plain text, with the receive connector scoped for only it's IP address.
We previously used SAN, but that was when we controlled the DNS records. Now we are a subdomain of a larger organization, and they control the DNS records. I can only do CV validation certificate, so I have to rely on their DNS admins to make the record and the validation to go through, not that big a deal, but still a PIA.
Thanks for the help, and explanation.
Here is how I see it.
Wildcards are not good for email servers but instead webservers.
SAN is required for exchange, why? because if you do not explicitly tell the server "hey these are the names you have to look for when you hit my exchange" if the name doesn't match the connection will fail.
I have seen many situations when it comes to wildcards, wildcards are really good when you have multiple sub-domains with websites.
And yes, it is good to have curiosity and if you have time to work with it, go for it, that's what I do :)
Wildcards are not good for email servers but instead webservers.
SAN is required for exchange, why? because if you do not explicitly tell the server "hey these are the names you have to look for when you hit my exchange" if the name doesn't match the connection will fail.
I have seen many situations when it comes to wildcards, wildcards are really good when you have multiple sub-domains with websites.
And yes, it is good to have curiosity and if you have time to work with it, go for it, that's what I do :)
-
![]()
SolutionSSL Certificate Cannot be Trusted, Certificate Signed Using Weak Hashing Algorithm, Certificate with Wrong Hostname -
![]()
ArticleHow to Renew SSL Certificate for Exchange 2013 Server Step by Step -
![]()
VideoExchange 2019 - Change the default timeout value for OWA -
![]()
Cloud Class®70-662 - Deploying Microsoft Exchange Server 2010
-
![]()
received a Solution
Exchange SSL Certificate Authentication -
![]()
wrote an Article
![]()
How to Renew SSL Certificate for Exchange 2013 Server Step by Step
-
![]()
created a Video
![]()
Exchange 2019 - Install Exchange 2019 Unattended
-
Explore Cloud Class® ![]()
70-662 - Deploying Microsoft Exchange Server 2010
Premium Content
You need an Expert Office subscription to comment.Start Free Trial