Exchange Server Forums

Certificates

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2010] >> Installation >> Certificates

Page: [1]

Message

<< Older Topic Newer Topic >>

Certificates - 19.Jan.2012 4:08:02 PM

hamid.azeez@hotmail.

Posts: 2
Joined: 19.Jan.2012
Status: offline

Greeting All!

My apologies in advance if I am posting in the wrong catagory.

I am hoping to get some guidance in a exchange 2010 deployment "How to issue" I am experiancing.

We currently have Exchange 2010 deployed in our AD 2003 environment. We are in plans to deploy a DAG and hub/CAS array environment.

2 hub/CAS servers, load balance using NLB. Hub and CAS roles on the same servers. All 64bit hardware windows 2008 R2.

So, I install on 1st server, the CAS role. I notice on a few users machine they are prompted with a certificate window stating "server does not have a valid certificate ..."

Since I am not versed in certificates for Exchange, could someone let me know or, provide me some link spefically to the CAS certicates I will need to install in my Exchange 2010 deployment?

I am not sure what additional information I will need to provide, I will make this my starting point and hope that someone ask me to provide additional information.

Thanks in adn

< Message edited by hamid.azeez@hotmail. -- 19.Jan.2012 4:10:16 PM >

_____________________________

Cheers,
Hamid

Post #: 1

Featured Links*

RE: Certificates - 20.Jan.2012 7:57:12 AM

de.blackman

Posts: 3542
Joined: 4.Apr.2005
From: Toronto, Canada
Status: offline

Have you purchased a public certificate for the CAS role and if so what URLs did you place on it? Are you implementing CAS Arrays?

_____________________________

Ibrahim Benna - Microsoft Exchange MVP
Forum Moderator
Navantis
@IbrahimBenna

(in reply to hamid.azeez@hotmail.)

Post #: 2

RE: Certificates - 20.Jan.2012 8:15:34 AM

RustyShackleford

Posts: 226
Joined: 13.Jan.2010
Status: offline

Are trusted certificates required for internal usage of CAS servers and CAS arrays?

(in reply to de.blackman)

Post #: 3

RE: Certificates - 20.Jan.2012 9:41:00 AM

hamid.azeez@hotmail.

Posts: 2
Joined: 19.Jan.2012
Status: offline

Guys, thank you for the reply...

In our existing 2010 environment, we have purchased certs to host our email over the internet...

at the moment, we have cert for...
webmail.domain.com and
autodiscover.domain.com

These certs are setup and in use at this time. We recently migrate from Domino to Exchange 2010. Problem is, I wasn't paying attention to this part when the certs were being installed :(!

Since we already have the certs within our environment, how do I add the newly installed CAS server to these certs so users aren't getting messages that the server is not a trusted server?

hope I am on the right track.

_____________________________

Cheers,
Hamid

(in reply to RustyShackleford)

Post #: 4

RE: Certificates - 20.Jan.2012 11:00:34 AM

de.blackman

Posts: 3542
Joined: 4.Apr.2005
From: Toronto, Canada
Status: offline

RustyShackleford - No trusted certificates are not required for internal usage of CAS servers and CAS Arrays! But if you plan on publishing Exchange to the internet and you still do not want to use a public certificate, you must ensure that the root certificate from your internal certification authority is installed on each client that will connect to exchange from the internet! Hence the reason why public certs are recommended (even by Microsoft).

HamidAzeez - You can contact the company you purchased your certificate from and ask them to include the new names on it. You will have to generate a new request file though.

_____________________________

Ibrahim Benna - Microsoft Exchange MVP
Forum Moderator
Navantis
@IbrahimBenna

(in reply to hamid.azeez@hotmail.)

Post #: 5

RE: Certificates - 24.Jan.2012 11:50:38 AM

madcow

Posts: 948
Joined: 28.May2001
From: Planet, Earth
Status: offline

I think you will have to re-request a new certficate with FQDN of your CAS on it along with what ever you have. Best bet is to have a *.domain.com. rather than names on the certificate.

< Message edited by madcow -- 24.Jan.2012 11:54:16 AM >

(in reply to hamid.azeez@hotmail.)

Post #: 6

RE: Certificates - 26.Jan.2012 7:51:49 AM

de.blackman

Posts: 3542
Joined: 4.Apr.2005
From: Toronto, Canada
Status: offline

Madcow you are correct in using a wildcard certificate it may not necessary be best practice and you have to remember that not all mobile devices support them.

http://technet.microsoft.com/en-us/library/dd351044.aspx#digitalcertificatesbestpractices

_____________________________

Ibrahim Benna - Microsoft Exchange MVP
Forum Moderator
Navantis
@IbrahimBenna

(in reply to madcow)

Post #: 7