I’ve done plenty of new self-signed certificates for Exchange. Most places don’t mind if the certificate displays an error when users visit the webmail site (OWA), but they do mind if the users receive an error saying the certificate name is invalid when using Outlook.<\/p>\n
Had the self-signed certificate installed on a standard Exchange 2007 server. CRM 4 requires an SSL\/TLS connection. While we could have created another internal certificate with the export = $true key, the customer also wanted to rid themselves from the invalid certificate when browsing to the Outlook Web Access site.<\/p>\n
Obviously replace “domain.tld” with your actual information.<\/p>\n
Create the certificate request:<\/p>\n
Open PowerShell on Exchange
\nNew-ExchangeCertificate -DomainName webmail.domain.tld,other.domain.tld,autodiscover.domain.tld -FriendlyName \"Site Webmail Certificate\" -GenerateRequest:$True -Keysize 2048 -path c:\\Webmailcertificate.txt -privatekeyExportable:$true -subjectName \"c=US, o=CompanyName Inc., OU=IT, L=City, S=State, CN=webmail.domain.tld\"<\/code><\/p><\/blockquote>\nPurchase the site certificate:<\/p>\n
Go to your favorite SSL supplier (Verisign, Thawte, etc.) and purchase an SSL Certificate. Standard is fine for this mostly internal-only site.
\nPaste the code from c:\\Webmailcertificate.txt when applicable
\nAfter the certificate has been authorized, download the .crt certificate and the intermediary Certificate Authority files<\/p><\/blockquote>\nInstall your certificate:<\/p>\n
Back on PowerShell for Exchange
\nImport-ExchangeCertificate -path c:\\webmailcertificate.txt<\/code>
\nGet-ExchangeCertificate<\/code>
\nCopy the Thumbprint from the NEW certificate (probably the one with “…..” listed under Services
\nEnable-ExchangeCertificate -Services IMAP, POP, UM, IIS, SMTP -Thumbprint 896B74B2YourExchangeThumbprintFC6A7<\/code>
\nClick Y for Yes if prompted to replace from an old(er) certificate<\/p><\/blockquote>\nNow your webmail access (OWA) should no longer have a certificate issue. However, if the issued name on the certificate is DIFFERENT from your NETBIOS name of your email server, you will have issues INTERNALLY. Namely, all of your outlook clients will report a certificate is invalid error – that the names do not match. This is because the Exchange Server now has the certificate that points to webmail.domain.tld and your outlook clients are pointing to exchange07.domain.local.<\/p>\n
To fix this issue:<\/p>\n
Once again, use PowerShell for Exchange
\nGet-ClientAccessServer<\/code>
\nCopy the servername<\/code>
\nSet-ClientAccessServer -Identity SERVERNAMEHERE -AutodiscoverServiceInternalUri https:\/\/webmail.domain.tld\/autodiscover\/autodiscover.xml<\/code>
\nSet-WebServicesVirtualDirectory -Identity \"SERVERNAMEHERE\\EWS (Default Web Site)\" -InternalUrl https:\/\/webmail.domain.tld\/ews\/exchange.asmx<\/code>
\nSet-OABVirtualDirectory -Identity \"SERVERNAMEHERE\\oab (Default Web Site)\" -InternalUrl https:\/\/webmail.domain.tld\/oab<\/code>
\nThere is one final step required – recycle the MSExchangeAutodiscoverAppPool:
\nOn Exchange 2007, Open IIS Manager
\nNavigate to Local Computer > Application Pools
\nRight-Click on MSExchangeAutodiscoverAppPool and select Recycle\n<\/p><\/blockquote>\nThat should be it. Everything works here after recycling.<\/p>\n
Or you could always just put in the required domains on your certificate request:
\nNetBIOS name
\nFQDN external (if different)
\nautodiscover.domain.tld
\nautodiscover.domain.local (if applicable)
\nwebmail.domain.tld (obviously change accordingly)<\/p>\n","protected":false},"excerpt":{"rendered":"I’ve done plenty of new self-signed certificates for Exchange. Most places don’t mind if the certificate displays an error when users visit the webmail site (OWA), but they do mind if the users receive an error saying the certificate name is invalid when using Outlook. Had the self-signed certificate installed on a standard Exchange 2007 … Continue reading Exchange 2007 3rd Party Certificate<\/span>