Exchange 2010 Migration - Decommissioning Multi Role Server and Splitting Roles to 2 new servers - Certificate Query

Question

Hi,
I have been tasked with decommissioning our single Multi Role Server (CAS/HT/MB) and assigning the roles to 2 new servers. 1 server will be dedicated to CAS and the other new server will be dedicated to HT & MB roles.
I think I'm OK with the moving of HT and MB roles from our current server to the new HT/MB server by following "Ed Crowley's Method for Moving Exchange Servers", my focus is on the migration of the CAS role from the current to the new server as
this one has the potential to kill our mail flow if I don't move the role correctly.
The actual introduction of the new CAS server is fairly straight forward but the moving of the certificate is where I need some clarification.
Our current multi role server has a 3rd Party Certificate with the following information:
Subject: OWA.DOMAIN.COM.AU
SANs: internalservername.domain.local
          autodiscover.domain.com.au
The issue here is the SAN entry "internalservername.domain.local" which will need to be removed in order for the certificate to be used on the new CAS server, firstly because the CAS server has a different name and secondly the internal FQDN will
no longer be allowed to be used from 2015 onwards. So I will need to revoke this certificate and issue a new certificate with our vendor who is Thawte.
This presents me with an opportunity to simplify our certificate and make changes to the URLs using a new certificate name, so I have proposed the following:
New Certificate:
Subject: mail.domain.com.au
SANs: autodiscover.domain.com.au
          OWA.DOMAIN.COM.AU
I would then configure the URLs using PowerShell:
Set-ClientAccessServer -Identity NEWCASNAME-AutodiscoverServiceInternalUrl https://mail.domain.com.au/autodiscover/autodiscover.xml
Set-WebServicesVirtualDirectory -Identity " NEWCASNAME\EWS (Default Web Site)" -InternalUrl https://mail.domain.com.au/ews/exchange.asmx
Set-OABVirtualDirectory -Identity " NEWCASNAME\oab (Default Web Site)" -InternalUrl https://mail.domain.com.au/oab
Set-OWAVirtualDirectory -Identity " NEWCASNAME\owa (Default Web Site)" -InternalUrl https://mail.domain.com.au/owa
I would also then set up split DNS on our internal DNS server creating a new zone called "mail.domain.com.au" and add an host A record with the internal IP address of the new CAS server.
Now I know I haven't asked a question yet and the only real question I have is to ask if this line of thinking and my theory is correct.
Have I missed anything or is there anything I should be wary of that has the potential to blow up in my face?
Thanks guys, I really appreciate any insights and input you have on this.

Answer 1

Hi Ed,
Thanks for your reply, it all makes perfect sense I guess I was being optimistic by shutting down the old server and then resubscribing the edge and testing with mailboxes on the new mailbox server.
I will make sure to move all of the mailboxes over before removing the old server via "Add/Remove Programs". Will I have to move the arbitration mailboxes on the old server across to the new mailbox server? Will having the arbitration mailboxes
on the old server stop me from completely removing exchange?
Also, the InternalURL & ExternalURL properties are as follows:
Autodiscover:
New CAS - InternalURL: https://svwwmxcas01.pharmacare.local/Autodiscover/Autodiscover.xml
Old CAS - InternalURL: https://svwwmx001.pharmacare.local/autodiscover/autodiscover.xml
WebServices:
New CAS - InternalURL: https://svwwmxcas01.pharmacare.local/EWS/Exchange.asmx
New CAS - ExternalURL: https://owa.pharmacare.com.au/EWS/Exchange.asmx
Old CAS - InternalURL: https://svwwmx001.pharmacare.local/ews/exchange.asmx
Old CAS - ExternalURL: https://owa.pharmacare.com.au/EWS/Exchange.asmx
OAB:
New CAS - InternalURL: http://svwwmxcas01.pharmacare.local/OAB
New CAS - ExternalURL: https://owa.pharmacare.com.au/OAB
Old CAS - InternalURL: https://svwwmx001.pharmacare.local/oab
Old CAS - ExternalURL: https://owa.pharmacare.com.au/OAB
OWA:
New CAS - InternalURL: https://svwwmxcas01.pharmacare.local/owa
New CAS - ExternalURL: https://owa.pharmacare.com.au/
Old CAS - InternalURL: https://svwwmx001.pharmacare.local/owa
Old CAS - ExternalURL: https://owa.pharmacare.com.au/
ECP:
New CAS - InternalURL: https://svwwmxcas01.pharmacare.local/ecp
New CAS - ExternalURL: https://owa.pharmacare.com.au/ecp
Old CAS - InternalURL: https://svwwmx001.pharmacare.local/ecp
Old CAS - ExternalURL: https://owa.pharmacare.com.au/ecp
Our Public Certificate has the following details:
Name: OWA.PHARMACARE.COM.AU
SAN/s: autodiscover.pharmacare.com.au, svwwmx001.pharmacare.local
From your previous communications you mentioned that this certificate would not need to change, it could be exported from the old server and imported to the new which I have done. With the InternalURL & ExternalURL information that you see here can you
please confirm that your original recommendation of keeping our public certificate and importing it into the new CAS is correct? Will we forever get the certificate warning on all of our Outlook clients when we cut over from the old to the new until we get
a new certificate with the SAN of "svwwmx001.pharmacare.local" removed?
Also, I am toying with the idea of implementing a CAS Array as I thought that implementing the CAS Array would resolve some of the issues I was having on Saturday. I have followed the steps from this website, http://exchangeserverpro.com/how-to-install-an-exchange-server-2010-client-access-server-array/,
and I have got all the way to the step of creating the CAS array in the Exchange Powershell but I have not completed this step for fear of breaking connectivity to all of my Outlook Clients. By following all of the preceeding steps I have created a Windows
NLB with dedicated NICs on both the old CAS and the new CAS servers (with separate IP addresses on each NIC and a new internal IP address for the dedicated CAS array) and given it the name of "casarray.pharmacare.local" as per the instructions on
the website, the questions I have on adding the CAS array are:
1. Do you recommend adding the CAS array using this configuration?
2. Will this break Outlook connectivity alltogether?
3. Will I have to generate a new Public Certificate with an external FQDN of "casarray.pharmacare.com.au" pointing back to a public IP or is it not required?
4. If this configuration is correct, and I add the CAS Array as configured, when the time comes to remove the old server is it just as simple as removing the NLB member in the array and everything works smoothly?
So, with all of the information at hand my steps for complete and successful migration would be as follows:
1. Move all mailboxes from old server to new server;
2. Move arbitration mailboxes if required;
3. Implement CAS Array and ensure that all Outlook clients connect successfully;
4. Remove old server;
5. Shut down old server;
6. Re-subscribe Edge from new Hub Transport server;
7. Test internal & external comms;
We also have internal DNS entries that would need changing:
1. We have split DNS with a FLZ of "owa.pharmacare.com.au" that has a Host A record going to the old server, this would need changing from "svwwmx001.pharmacare.local" to "svwwmxcas01.pharmacare.local";
2. The _autodiscover entry that sits under _TCP currently has the IP address of the old server, this would need to be changed to the IP address of the new CAS;
3. The CNAME that sits in our FLZ for "pharmacare.local" would need to be changed from "svwwmx001.pharmacare.local" to "svwwmxcas01.pharmacare.local".
4. Or rather than using the FQDN of the server where applicable in the DNS changes would I be using the FQDN of the CAS Array instead? Please confirm.
Would you agree that the migration path and DNS change plan is correct?
Sorry for the long post, I just need to make sure that everything goes right and I don't have egg on my face. I appreciate your help and input.
Thanks again.
Regards,
Jamie