Configuring exchange 2013 with MS PKI

Question

while trying to configure exchange to work with certificates issued from my internal MS PKI, I deleted the self signed certificates. and now I can't access exchange. the good thing is that this is not a production environment yet. I was looking around and
I couldn't find a documentation on how to request certificates from an internal CA. and how to assign the certificate to exchange.
I need help regarding this, if any one has a working environment with CAS and MB on different server, how the certificates are assigned in IIS.

Answer 1

Hi mtxfayez,
First, I would like to share some information on Self-signed certificate and PKI certificate.
1. Self-signed certificate.
This self-signed certificate is used to encrypt communications between the Client Access server and the Mailbox server. The Client Access server trusts the self-signed certificate on the Mailbox server automatically, so no third-party
certificate is needed on the Mailbox server.
By default, the digital certificate installed on the Mailbox server or servers is a self-signed certificate. You don’t need to replace the self-signed certificate on the Mailbox servers in your organization with a trusted third-party certificate. The
Client Access server automatically trusts the self-signed certificate on the Mailbox server and no other configuration is needed for certificates on the Mailbox server.
2. PKI certificate.
If you obtain certificates from a domain-joined Windows CA, you can use the CA to request or sign certificates to issue to your own servers or computers on your network. This enables you to use a PKI that resembles a third-party certificate vendor,
but is less expensive. These PKI certificates can't be deployed publicly, as other types of certificates can be.
The steps for deploying a PKI-generated certificate resemble those required for deploying a self-signed certificate. You must still install a copy of the trusted root certificate from the PKI to the trusted root certificate store of the computers or
mobile devices that you want to be able to establish an SSL connection to Microsoft Exchange.
Note: One problem with self-signed and PKI-based certificates is that, because the certificate is not automatically trusted by the client computer or mobile device, you must make sure that you import the certificate into
the trusted root certificate store on client computers and devices.
More details in the following article:
http://technet.microsoft.com/en-us/library/dd351044(v=exchg.150).aspx
Second, about "how to request certificates from an internal CA" and "how to assign the certificate to exchange", found a great blog for your reference:
Enterprise PKI with Windows Server 2012 R2 Active Directory Certificate Services (Part 1 of 2)
http://blogs.technet.com/b/yungchou/archive/2013/10/21/enterprise-pki-with-windows-server-2012-r2-active-directory-certificate-services-part-1-of-2.aspx
Enterprise PKI with Windows Server 2012 R2 Active Directory Certificate Services (Part 2 of 2)
http://blogs.technet.com/b/yungchou/archive/2013/10/22/enterprise-pki-with-windows-server-2012-r2-active-directory-certificate-services-part-2-of-2.aspx
Last, if it still not works well, please paste the detailed error message without sensitive information for the further troubleshooting.
Hope it is helpful
Thanks
Mavis
Mavis Huang
TechNet Community Support