Certificate choices for Exchange 2013, ADFS and WAP

This question has now been 'moved' to Windows Security.
Can you please help me with certificate choices?
We currently have an Exchange 2013 server publishing OWA, EAS, etc. externally with ISA server and a DigiCert certificate on both servers. The certificate has multiple SANs. Everything is good.
We now want to ditch ISA server and use Microsoft’s Web Application Proxy with ADFS services and I’m looking to simplify the certificate requirements.
I read in the ADFS/WAP certificate requirements that the Subject name (CN) and the SAN entry need to be the same. If I changed the current certificate, I'm not sure whether it would break the Exchange certificate requirements.
So, can you tell me if I can switch to a single wildcard certificate and use it for all these services, i.e. Exchange, WAP and ADFS servers?
Thank you in anticipation,
Andy.

Hello,
you may ask this the Security experts in
http://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserversecurity
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://blogs.msmvps.com/MWeber
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
Twitter:

Similar Messages

Android & WM6.5 devices can't use ActiveSync with Exchange 2013, ADFS and WAP.

Bit of a long winded title but I was trying to sum up the issue.
Newly installed Exchange 2013 environment; we've setup external access for OA and ActiveSync. We've used ADFS with WAP to publish the necessary paths etc. We've setup DNS and firewall rules etc.
OA is perfect and can be accessed by anything with a browser. ActiveSync is perfect for any new Windows Mobile device and any iOS device. When we've tried to sync older WM6.5 or any Android device, it just doesn't seem to want to work.
We've checked logs on both devices; the WM6.5 complains about a cert issue however we've took every step from installing the CA, RA and actual cert on the device to no avail. Some android device complain about using the port 443 but no matter what
we change this to it still won't sync.
Unfortunately my suggestion of 'just give everyone a new phone' went down as well as...well lets just say not good :)
I appreciate this might be an ADFS\WAP issue but thought I'd rule Exchange out first so any advice is much appreciated.

We are having issues on connecting ActivySync on Microsoft Exchange 2013.
OWA,OutlookAnywhere is working
ActiveSync is not working.
can you help us or share the configuration.
We have Used MS UAG2010 SP4 to publish Exchange 2013 SP1 (On premises).
Regards,
Furqan

Certificate configuring for exchange 2013 and office 365 hybrid deployment

Please advise on what digital certificate requirements for hybrid deployment and to configure it.

Hi sphilip,
If you want to deploy AD FS with Single Sign-On(SSO), we need use certificate to establish secure trust between on-premises Exchange 2013 and Office online.
We can use and configure a trusted third-part CA within all on-premises Exchange 2013 Mailbox and Client Access servers to ensure secure mail transport, more details about
Office 365 Hybrid Configuration Certificate Planning, for your reference:
http://blogs.technet.com/b/neiljohn/archive/2011/08/25/office-365-hybrid-configuration-certificate-planning-adfs-exchange-web-services-owa-oa.aspx
Best Regards,
Allen Wang

How to configure AD on windows 2012 server for Exchange 2013 internal and external email flow

Dear Experts,
I have to configure exchange 2013 on Windows server 2012 STD. Company has registered Static IP addresses and can get the MX record pointing to any of this Static IP.
The registered domain name is e.g. contoso.com.
a. What should I use as domain name on AD? contoso.com or contoso.local
b. Is it recommended to have two different servers for AD and Exchange?
c. What should be my connector settings for mail flow?
d. how can I set 2 email servers in company for load balancing?

Hi,
a, I suggest use contoso.com as domain name. It is convenient to add urls into our certificate for internal and external mail flow.
b, Recommended that installing AD
and Exchange Server on two separate
Servers. If Exchange Server downed unfortunately, it can prevent AD server from crushing at the same time.
c, Found some articles for your reference:
Configure Mail Flow and Client Access
http://technet.microsoft.com/en-us/library/jj218640(v=exchg.150).aspx
Configuring Outbound Mail Flow in Exchange Server 2013
http://exchangeserverpro.com/configuring-outbound-mail-flow-in-exchange-server-2013/
d, Load Balancing
http://technet.microsoft.com/en-us/library/jj898588(v=exchg.150).aspx
Hope it is helpful
Thanks
Mavis
Mavis Huang
TechNet Community Support

Certificate Authority for Exchange 2013

Dear,
I will install exchange 2013, whether to install the Certificate Authority role also?
If it is necessary, to install this CA, is simply combined with ADDS server, Exchange Server or a separate server?
Thanks

Hi,
As all above says, Exchange 2013 can use Self-signed Exchange certificate which is installed automatically after Exchange 2013 installation. But please note that this self-signed certificate would be not trusted for Exchange using.
If your Exchange 2013 is not internet-facing, we can use the self-signed certificate in your internal domain environment. If you want to publish your Exchange 2013 to the internet and send/receive external mails, we need to have a valid and trusted certificate
for Exchange using.
To get trusted certificate, we can deployed an
Enterprise root CA which self-signs its own CA certificate and uses Group Policy to publish that certificate to the Trusted Root Certification Authorities store of all servers and workstations in the domain. Or we can directly buy a third-party certificate
for using.
About where to install the CA, my personal suggestion is to install ADCS (Active Directory Certificate Services) on a standalone server. You can also install it with your DC. About how to install a
Root Certification Authority, please refer to:
http://technet.microsoft.com/en-us/library/cc731183.aspx
Regards,
Winnie Liang
TechNet Community Support

Best practices for buying a digital certificate for Exchange 2013

Good dayfriends,
Could you indicateme which are the bestpractices when buying
a public digital certificatefor use onExchangeServer 2013.
I'd be interested in knowing your opinion about
using wildcardor SAN certificates.
Likewise what are the best recommendations
to include names and why they should or
should not include the internal FQDN
of my servers.
Currently I have an infrastructure that has two
MailBox servers,two CAS servers and an EDGE
2010 server, but I'm planning update it to Exchange 2013.
I searched what are the best
practices according to Microsoft but
have found little information.
I would appreciate
if you can post links like
Microsoft KBs and other technical documents that
discuss the above mentioned.
Thanking your
invaluable support.
Greetings.

Hi,
Personal suggestion, we can use two namespaces for your Exchange 2013:
Autodiscover.domain.com (Used for autodiscover service)
Mail.domain.com (used for all Exchange services external and internal URLs)
Please pointed mail.domain.com and autodiscover.domain.com to your internet facing CAS 2013.
For more information about Digital Certificates and SSL in Exchange 2013, please refer to the
Digital Certificates Best Practices part in the following technet article:
http://technet.microsoft.com/en-us/library/dd351044%28v=exchg.141%29.aspx?lc=1033
Additionally, here are some other scenarios about certificate planning in Exchange 2013:
http://blogs.technet.com/b/exchange/archive/2014/03/19/certificate-planning-in-exchange-2013.aspx
Regards,
Winnie Liang
TechNet Community Support

SP1 for Exchange 2013 install fails with ECP virtual directory issues and now transport service won't start and mail is unavailable

SP1 for Exchange 2013 install failed on me with ECP virtual directory issues:
Error:
The following error was generated when "$error.Clear();
          $BEVdirIdentity = $RoleNetBIOSName + "\ecp (name)";
          $be = get-EcpVirtualDirectory -ShowMailboxVirtualDirectories -Identity $BEVdirIdentity -DomainController $RoleDomainController -ErrorAction SilentlyContinue;
          if ($be -eq $null)
          new-EcpVirtualDirectory -Role Mailbox -WebSiteName "name" -DomainController $RoleDomainController;
          set-EcpVirtualdirectory -Identity $BEVdirIdentity -FormsAuthentication:$false -WindowsAuthentication:$true;
          set-EcpVirtualdirectory -Identity $BEVdirIdentity -InternalUrl $null -ExternalUrl $null;
          . "$RoleInstallPath\Scripts\Update-AppPoolManagedFrameworkVersion.ps1" -AppPoolName:"MSExchangeECPAppPool" -Version:"v4.0";
        " was run: "The virtual directory 'ecp' already exists under 'server/name'.
Parameter name: VirtualDirectoryName".
Error:
The following error was generated when "$error.Clear();
          $BEVdirIdentity = $RoleNetBIOSName + "\ECP (name)";
          $be = get-EcpVirtualDirectory -ShowMailboxVirtualDirectories -Identity $BEVdirIdentity -DomainController $RoleDomainController -ErrorAction SilentlyContinue;
          if ($be -eq $null)
          new-EcpVirtualDirectory -Role Mailbox -WebSiteName "name" -DomainController $RoleDomainController;
          set-EcpVirtualdirectory -Identity $BEVdirIdentity -FormsAuthentication:$false -WindowsAuthentication:$true;
          set-EcpVirtualdirectory -Identity $BEVdirIdentity -InternalUrl $null -ExternalUrl $null;
          . "$RoleInstallPath\Scripts\Update-AppPoolManagedFrameworkVersion.ps1" -AppPoolName:"MSExchangeECPAppPool" -Version:"v4.0";
        " was run: "The operation couldn't be performed because object 'server\ECP (name)' couldn't be found on 'DC0xx.domain.com'.".
Error:
The following error was generated when "$error.Clear();
          $BEVdirIdentity = $RoleNetBIOSName + "\ECP (name)";
          $be = get-EcpVirtualDirectory -ShowMailboxVirtualDirectories -Identity $BEVdirIdentity -DomainController $RoleDomainController -ErrorAction SilentlyContinue;
          if ($be -eq $null)
          new-EcpVirtualDirectory -Role Mailbox -WebSiteName "name" -DomainController $RoleDomainController;
          set-EcpVirtualdirectory -Identity $BEVdirIdentity -FormsAuthentication:$false -WindowsAuthentication:$true;
          set-EcpVirtualdirectory -Identity $BEVdirIdentity -InternalUrl $null -ExternalUrl $null;
          . "$RoleInstallPath\Scripts\Update-AppPoolManagedFrameworkVersion.ps1" -AppPoolName:"MSExchangeECPAppPool" -Version:"v4.0";
        " was run: "The operation couldn't be performed because object 'server\ECP (name)' couldn't be found on 'DC0xx.domain.com'.".
!! And now transport service won't start and mail is unavailable !!
Any help would be appreciated.
I have removed the ecp site from default site and attempting to rerun SP1 now. I do not have high hopes. :(

Hi,
Thanks for your response.
From the error description, you need to manually remove the ECP with IIS manager in both the Default Web Site and the Exchange Back End firstly. And then continue the upgrade to check the result.
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

Antispam and AntiVirus for Exchange 2013

Dear All,
We running Exchange 2013, Would some please recommand us which antispam filter and antivirus tool is good for exchange 2013. Previously, for exchange 2010 micrsosoft has provided forfront but this has been going to disconnect any future release and
support will be stopped after 31 dec 2015. Do micrsoft have any tool for exchange 2013 for antivirus and antispam.

Hi,
You could have a look at Exchange Online Protection.
http://technet.microsoft.com/en-us/library/jj723137(v=exchg.150).aspx
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Configuring Lync Server 2013 to be a partner Application for Exchange 2013

Hello Guys,
I just want to share my experience while configuring Lync server 2013 to be a partner Application for exchange 2013 sever.
As mentioned on technet you need to run Configure-EnterprisePartnerApplication.ps1 script that ships with Exchange 2013.
But when I tried to run the script as described on the technet article, I found it always fails with " the accepted domain is not valid"
I have checked my accepted domains many times and i found that there's no issues with my configured accepted domain.
So I started to review the script to find the issue and I found that the script was configured as below
$acceptedDomains = Get-AcceptedDomain ;
if ($acceptedDomains -eq $null)
WriteError ("There is no accepted domain so user can not be created.")
$acceptedDomain = $acceptedDomains[0].Name;
if($UseDomainController -eq $true)
$user = New-MailUser -Name $username -DomainController $DomainController -ExternalEmailAddress $username@$acceptedDomain;
set-mailuser -Identity $user.Identity -HiddenFromAddressListsEnabled $true -DomainController $DomainController
else
$user = New-MailUser -Name $username -ExternalEmailAddress $username@$acceptedDomain;
set-mailuser -Identity $user.Identity -HiddenFromAddressListsEnabled $true;
which is totally wrong as below:
firstly it makes $AcceptedDomain variable to equal the Name of the accepted domain.
Not all customers configure the name of the Accepted Domain to be the Domain Name.
Secondly it makes $AcceptedDomain variable to equal the name of the first Accepted Domain.
The first domain may be not the default Accepted Domain.
So I have configured the script as below
$acceptedDomains = Get-AcceptedDomain | ? {$_.Default -eq "True"} ;
if ($acceptedDomains -eq $null)
WriteError ("There is no accepted domain so user can not be created.")
$acceptedDomain = $acceptedDomains.DomainName;
if($UseDomainController -eq $true)
$user = New-MailUser -Name $username -DomainController $DomainController -ExternalEmailAddress $username@$acceptedDomain;
set-mailuser -Identity $user.Identity -HiddenFromAddressListsEnabled $true -DomainController $DomainController
else
$user = New-MailUser -Name $username -ExternalEmailAddress $username@$acceptedDomain;
set-mailuser -Identity $user.Identity -HiddenFromAddressListsEnabled $true;
I hope This help.
Thanks
Ahmed Fouad

Hi,
This is helpful, thanks for sharing.
Best regards,
Belinda Ma
TechNet Community Support

Exchange 2013 SP1 and CUCM 9.1.2 - Exch not recognizing called extension

I think I'm almost there in getting Exchange 2013 SP1 UM working with CUCM 9.1.2...I've got two issues at the moment that I need a little help with.
1) When I dial my VM pilot (6040) from a UM enabled extension it prompts to enter an extension. When I dial the same extension and let it ring to VM, Exchange picks up and says "the person you are trying to reach does not have a valid voice mail box
on our system".
2) This just started happening this afternoon, when I dial my VM pilot (6040) exch3 picks up as thats what I have my route pattern pointing to. If I enter the extension of a mailbox on exch2, I get stuck in a endless loop.
I've followed this post as a guide but it hasn't resolved my issue.
https://supportforums.cisco.com/discussion/11914031/exchange-2013-um-and-cucm-86
My Exchange environment looks like this:
Site 1:
exch1 - CAS/Mailbox, used for mainly utility type work, journal, dedicated SMTP flows etc
exch2 - CAS/Mailbox, part DAG13
exch3 - CAS/Mailbox, part of DAG13
Site 2:
exch2dr - CAS/Mailbox, part of DAG13
exch3dr - CAS/Mailbox, part of DAG13
DAG13 is stretched between two sites, there are no users at our DR site so CUCM is pointing to Site 1 for UM. Each site has an internet facing CAS-only server for OWA/EAS etc.
Any help is greatly appreciated. I'd love to get rid of Unity.
EDIT:
I just found this event in the event logs:
The Microsoft Exchange Unified Messaging service on the Mailbox server received a diverted call with ID "d51600-3a3140c5-9b8-c1414ac@EXCH3-IPADDR" for extension "4099" on UM dial plan "CUCM" from UM IP gateway "CUCM IP",
but no UM-enabled mailbox for the corresponding extension could be found. Please check the extension and make sure that the corresponding mailbox is enabled for UM and associated with the correct UM dial plan.

9.1.2 I think it is, we upgraded to avoid the known DNS bug
I cant see how to PM you either
The crux of it was outlined below with some tweaks
http://blogs.technet.com/b/canitpro/archive/2014/04/30/step-by-step-integration-between-exchange-2013-um-and-cisco-unified-communication-manager.aspx
As we have multiple combined role servers, our trunks are set up as follows:
1. 1 x CAS Trunk - contains all CAS Servers on port 5060
2. 4 x MBX Trunks - contains Maibox Server with ports 5062-5068
On top of that, we had to Allow "Redirecting Diversion Header Delivery - Inbound (and Outbound)" on the CAS Trunk but DISABLE it on the Mailbox Trunks
Also, make sure that you are using Telephone Extension Dial plans in Exchange 2013 (Despite them being unable to be associated with a 13 Server - EX13 answers for all calls anyway)
Lastly, the MS documentation is a little strange - it says that as your last step of UM migration, you should point your Call Manager to 2013 - I don't agree with that statement, EX13 routes calls back to 2010 UM Servers perfectly fine, so treat it the same
as any other CAS based service - point to 2013, and it will handle the rest

Exchange 2010 to Exchange 2013 Migration and Architect a resilient and high availability exchange setup

Hi,
I currently have a single Exchange 2010 Server that has all the roles supporting about 500 users. I plan to upgrade to 2013 and move to a four server HA Exchange setup (a CAS array with 2 Server as CAS servers and one DAG with 2 mailbox Servers). My
goal is to plan out the transition in steps with no downtime. Email is most critical with my company.
Exchange 2010 is running SP3 on a Windows Server 2010 and a Separate Server as archive. In the new setup, rather than having a separate server for archiving, I am just going to put that on a separate partition.
Here is what I have planned so far.
1. Build out four Servers. 2 CAS and 2 Mailbox Servers. Mailbox Servers have 4 partitions each. One for OS. Second for DB. Third for Logs and Fourth for Archives.
2. Prepare AD for exchange 2013.
3. Install Exchange roles. CAS on two servers and mailbox on 2 servers. Add a DAG. Someone had suggested to me to use an odd number so 3 or 5. Is that a requirement?
4. I am using a third party load balancer for CAS array instead of NLB so I will be setting up that.
5. Do post install to ready up the new CAS. While doing this, can i use the same parameters as assigned on exchange 2010 like can i use the webmail URL for outlook anywhere, OAB etc.
6. Once this is done. I plan to move a few mailboxes as test to the new mailbox servers or DAG.
7. Testing outlook setups on new servers. inbound and outbound email tests.
once this is done, I can migrate over and point all my MX records to the new servers.
Please let me know your thoughts and what am I missing. I like to solidify a flowchart of all steps that I need to do before I start the migration.
thank you for your help in advance

Hi,
okay, you can use 4 virtual servers. But there is no need to deploy dedicated server roles (CAS + MBX). It is better to deploy multi-role Exchange servers, also virtual! You could install 2 multi-role servers and if the company growths, install another multi-role,
and so on. It's much more simpler, better and less expensive.
CAS-Array is only an Active Directory object, nothing more. The load balancer controls the sessions on which CAS the user will terminate. You can read more at
http://blogs.technet.com/b/exchange/archive/2014/03/05/load-balancing-in-exchange-2013.aspx Also there is no session affinity required.
First, build the complete Exchange 2013 architecture. High availability for your data is a DAG and for your CAS you use a load balancer.
On channel 9 there is many stuff from MEC:
http://channel9.msdn.com/search?term=exchange+2013
Migration:
http://geekswithblogs.net/marcde/archive/2013/08/02/migrating-from-microsoft-exchange-2010-to-exchange-2013.aspx
Additional informations:
http://exchangeserverpro.com/upgrading-to-exchange-server-2013/
Hope this helps :-)

Is smb 3.0 already supported for exchange 2013

Hello,
We are looking to deploy exchange 2013. We have a netapp storage and vmware environment.
I was wondering if smb 3.0 is already supported for exchange 2013. I read in a blog of 2012 that it wasn't supported at the time. We would like to use it instead of a iscsi lun.

Hi,
Based on my knowledge, it is still not supported for Exchange 2013 up to now.
Here is an article for your reference, please refer to the "Exchange storage requirements" section.
Exchange 2013 Virtualization
http://technet.microsoft.com/en-us/library/jj619301.aspx#BKMK_Prereq
Another related article for your reference.
Exchange 2013 Storage Configuration Options
http://technet.microsoft.com/en-us/library/ee832792(v=exchg.150).aspx
Best regards,
Belinda
Belinda Ma
TechNet Community Support

It is there an alternative to the Test-SystemHealth powershell cmdlet for Exchange 2013?

Hello
The Powershell cmdlet Test-SystemHealth, that was available on Exchange 2010, is no longer available on Exchange 2013.
Test-SystemHealth cmdlet gathered data about the Microsoft Exchange system and analyzed the data according to best practices.
Are there any alternatives to this for Exchange 2013?
Thanks!

Haven't really played with it too much, but check out Get-ServerHealth
http://technet.microsoft.com/en-us/library/jj218703(v=exchg.150).aspx
Looks to have replaced Test-SystemHealth.

Best Practice Analyzer for Exchange 2013

Greetings,
I have upgraded the messaging infrastructure from Exchange 2007 to Exchange 2013.
I want to test the Health of the system through ExBPA for Exchange 2013.
But i don't find any setup for Exchange 2013 like it was in 2010.
I went through an article by Office365 community, according to which for In-premises Exchange also we need to have office 365 account (can use trial account also) to get the downloader file for ExBPA 2013.
http://community.office365.com/en-us/w/deploy/office-365-best-practices-analyzer-for-exchange-server-2013.aspx
But to run the setup the servers needs to be connected to internet.
And, i don't want to expose my environment to internet in any condition.
Somebody, please suggest me if there is any setup available so that i can install directly without exposing to internet.
Thanks in advance.
Best Regards,
K2

Welcome to Exchange 2013.
Exchange Server 2013 doesn't come with ExBPA for health check. This might help
http://exchangeserverpro.com/powershell-script-health-check-report-exchange-2010/
Apart from that you can run these commands too
Get-ServerHealth -Identity Exchange2013ServerName
Test-ServiceHealth
Cheers,
Gulab Prasad
Technology Consultant
Blog:
http://www.exchangeranger.com    Twitter:
  LinkedIn:
   Check out CodeTwo’s tools for Exchange admins
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

Jetstress tool for Exchange 2013

Greetings
I am upgrading the Exchange 2013 environment and want to run the Jetstress tool before putting the servers in production.
I have 2 Mailbox servers as member of DAG.
Please provide me inputs on below mentioned points:
1. As per microsoft recommendations, the Jetstress tool should be run before installing Exchange Server.
However, i have already installed Exchange server and done the CAS Virtual Directories configuration.
Is it possible if i can run Jetstress after installing Exchange Server.
2. Now, the Exchange is already installed. DO i need to run Jetstress on all DAG members.
Thanks in advance.

Hi
Preferably, Jetstress testing should be performed before you install Exchange on the server. There are some well-known risks associated with running Jetstress on a machine with Exchange installed. If you use a version of Jet (ESE.DLL and ESEPERF.*) different
than the version installed with Exchange, the registration of the Jet database counters in the Jetstress install directory will broke the database counters for Exchange after Jetstress is removed. You may have to uninstall the existing Exchange Database Engine
counters before you run Jetstress, by running unlodctr ESE at a command prompt. However, you will still have to uninstall and reinstall the Exchange version of the Exchange Database Engine counters when testing is completed.
Summary - It is not advisable to run jetstress on a production exchange server which will lead to multiple complications.
Remember to mark as helpful if you find my contribution useful or as an answer if it does answer your question.That will encourage me - and others - to take time out to help you Check out my latest blog posts on http://exchangequery.com Thanks Sathish
(MVP)

Certificate choices for Exchange 2013, ADFS and WAP

Similar Messages

Maybe you are looking for