asked on
Hello All,
I have my exchange 2019 server setup and working fine for passing mail. OWA and the wildcard cert I have works fine for OWA, mail clients, etc. No problems with normal mail flow, or utilizing the wildcard cert I purchased from Sectigo RSA Domain Validation Secure Server .
I do have an issue when attempting to telnet into Exchange using openssl in order to run starttls. I am able to get connected via openssl and I am passed a certificate from the exchange server, BUT it is not the certificate I am expecting. Instead of getting the wildcard certificate from Sectigo RSA Domain Validation Secure Server , I am getting a self signed certifcate. Which is why I believe my Ehlo after starttls fals with '501 5.5.4 Invalid domain name'.
Looking at EAC I have four certificates total
Name: Microsoft Exchange, self signed certificate, assigned services: SMTP
Name: Microsoft Exchange Server Auth Certificate, self-signed certificate, assigned to services SMTP
Name: Wild, Sectigo RSA Domain Validation Secure Server, assigned services IMAP, POP, IIS, SMTP
Name: WMSVC-SHA2, self-signed certificate, assigned to services SMTP.
Can I remove any of the self-signed certificates?
Is there a way to specify when using openssl to specify which certificate it should use?
my understanding is IIS needs the WMSVC-SHA2 cert....
I have my exchange 2019 server setup and working fine for passing mail. OWA and the wildcard cert I have works fine for OWA, mail clients, etc. No problems with normal mail flow, or utilizing the wildcard cert I purchased from Sectigo RSA Domain Validation Secure Server .
I do have an issue when attempting to telnet into Exchange using openssl in order to run starttls. I am able to get connected via openssl and I am passed a certificate from the exchange server, BUT it is not the certificate I am expecting. Instead of getting the wildcard certificate from Sectigo RSA Domain Validation Secure Server , I am getting a self signed certifcate. Which is why I believe my Ehlo after starttls fals with '501 5.5.4 Invalid domain name'.
Looking at EAC I have four certificates total
Name: Microsoft Exchange, self signed certificate, assigned services: SMTP
Name: Microsoft Exchange Server Auth Certificate, self-signed certificate, assigned to services SMTP
Name: Wild, Sectigo RSA Domain Validation Secure Server, assigned services IMAP, POP, IIS, SMTP
Name: WMSVC-SHA2, self-signed certificate, assigned to services SMTP.
Can I remove any of the self-signed certificates?
Is there a way to specify when using openssl to specify which certificate it should use?
my understanding is IIS needs the WMSVC-SHA2 cert....
Learn from the best
Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.
Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 9 Comments.
Try for 7 days”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.
Our community of experts have been thoroughly vetted for their expertise and industry experience.
The Distinguished Expert awards are presented to the top veteran and rookie experts to earn the most points in the top 50 topics.