troubleshooting Question

Exchange Default Self Signed Certificates

Avatar of DeZo1
DeZo1Flag for United States of America asked on
ExchangeSSL / HTTPS
9 Comments1 Solution145 ViewsLast Modified:
Hello All,

I have my exchange 2019 server setup and working fine for passing mail.  OWA and the wildcard cert I have works fine for OWA, mail clients, etc.  No problems with normal mail flow, or utilizing the wildcard cert I purchased from Sectigo RSA Domain Validation Secure Server .

I do have an issue when attempting to telnet into Exchange using openssl in order to run starttls.  I am able to get connected via openssl and I am passed a certificate from the exchange server, BUT it is not the certificate I am expecting.  Instead of getting the wildcard certificate from Sectigo RSA Domain Validation Secure Server , I am getting a self signed certifcate.  Which is why I believe my Ehlo after starttls fals with '501 5.5.4 Invalid domain name'.

Looking at EAC I have four certificates total
Name:  Microsoft Exchange,  self signed certificate, assigned services:  SMTP
Name:  Microsoft Exchange Server Auth Certificate, self-signed certificate, assigned to services SMTP
Name:  Wild, Sectigo RSA Domain Validation Secure Server, assigned services IMAP, POP, IIS, SMTP
Name:  WMSVC-SHA2, self-signed certificate, assigned to services SMTP.

Can I remove any of the self-signed certificates?

Is there a way to specify when using openssl to specify which certificate it should use?

my understanding is IIS needs the WMSVC-SHA2 cert....
ASKER CERTIFIED SOLUTION
Hemil Aquino
Network Security Engineer
Join our community to see this answer!
Unlock 1 Answer and 9 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 9 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros