Exchange SAN Certificate Help!

Question

Hello,
I need some help in troubleshooting a problem I have with a customers’ Exchange 2007 server.
I installed a new SSL SAN cert on their only Exchange server yesterday, and today users are receiving certificate name mismatch prompts when opening their Outlook 2007 clients.
The previous cert had the local host name in the SAN cert, but given the changes around using local host names in certs soon to be implemented, I Ieft these entries out this time around with the new cert.
I already have a split horizon DNS zone within the local domain, which contains an A record for Autodiscover.
So, the setup is as follows:-
New SSL SAN cert:
CN= mail.domain.co.uk
SAN= autodiscover.domain.co.uk, owa.domain.co.uk
Split horizon DNS zone: (within domain.local AD domain)
autodiscover.domain.co.uk
A record: autodiscover.domain.co.uk = IP of Exchange server
The output from an Outlook client auto configuration test are listed below:
<LegacyDN>/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=TestUser1</LegacyDN>
      <DeploymentId>64a06c34-547e-44d8-8885-aa8fd530e2a1</DeploymentId>
    </User>
    <Account>
      <AccountType>email</AccountType>
      <Action>settings</Action>
      <Protocol>
        <Type>EXCH</Type>
        <Server>EXCHSRV01.domain.local</Server>
        <ServerDN>/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=EXCHSRV01</ServerDN>
        <ServerVersion>72038053</ServerVersion>
        <MdbDN>/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=EXCHSRV01/cn=Microsoft Private MDB</MdbDN>
        <PublicFolderServer>EXCHSRV01.domain.local</PublicFolderServer>
        <AD>EXCHSRV01.domain.local</AD>
        <ASUrl>https://EXCHSRV01.domain.local/EWS/Exchange.asmx</ASUrl>
        <EwsUrl>https://EXCHSRV01.domain.local/EWS/Exchange.asmx</EwsUrl>
        <OOFUrl>https://EXCHSRV01.domain.local/EWS/Exchange.asmx</OOFUrl>
        <UMUrl>https://EXCHSRV01.domain.local/UnifiedMessaging/Service.asmx</UMUrl>
        <OABUrl>http://EXCHSRV01.domain.local/OAB/5642c2e4-e31e-4ab8-89e7-d4590570249b/</OABUrl>
      </Protocol>
      <Protocol>
        <Type>EXPR</Type>
        <Server>mail.domain.co.uk</Server>
        <SSL>On</SSL>
        <AuthPackage>Ntlm</AuthPackage>
        <ASUrl>https://mail.domain.co.uk/EWS/Exchange.asmx</ASUrl>
        <EwsUrl>https://mail.domain.co.uk/EWS/Exchange.asmx</EwsUrl>
        <OOFUrl>https://mail.domain.co.uk/EWS/Exchange.asmx</OOFUrl>
        <OABUrl>http://mail.domain.co.uk/OAB/5642c2e4-e31e-4ab8-89e7-d4590570249b/</OABUrl>
      </Protocol>
      <Protocol>
        <Type>WEB</Type>
        <External>
          <OWAUrl AuthenticationMethod="Fba">https://mail.domain.co.uk/owa</OWAUrl>
          <Protocol>
            <Type>EXPR</Type>
            <ASUrl>https://mail.domain.co.uk/EWS/Exchange.asmx</ASUrl>
          </Protocol>
        </External>
        <Internal>
          <OWAUrl AuthenticationMethod="Basic, Fba">https://EXCHSRV01.domain.local/owa</OWAUrl>
          <Protocol>
            <Type>EXCH</Type>
            <ASUrl>https://EXCHSRV01.domain.local/EWS/Exchange.asmx</ASUrl>
          </Protocol>
        </Internal>
      </Protocol>
    </Account>
  </Response>
</Autodiscover>
As the SCP was originally pointing to the local fqdn of the Exchange server, I have amended the binding in ADSS so that the SCP now points to the autodiscover.domain.co.uk A record instead.
I took this step because even with the internal URL for Autodiscover's virtual directory set to https://autodiscover.domain.co.uk/Autodiscover/autodiscover.xml this path was ignored and Outlook defaulted to the fqdn of the local server.
I thought this might rectify the issue but to no avail.
The security prompt when opening Outlook still references the fact that the EXCHSRV01.domain.local does not match the CN of the cert mail.domain.co.uk.
Can anyone assist in troubleshooting this further?
Regards
Matt
Matt

Answer 1

Hi Matt,
We can run the following command to check your certificate settings in your Exchange server:
Get-ExchangeCertificate | FL
If your SAN certificate is assigned with IIS service, please change your internal URLs to match your SAN certificate names with IIS service. We can refer to the following KB to achieve Internal URLs changes:
http://support.microsoft.com/kb/940726
Thanks,
Winnie Liang
TechNet Community Support