.local domain and autodiscover issues

I want to preface this by saying I am a new administrator.
Our SSL cert recently expired, and since .local domains can no longer be on certs, were registered a CA cert with autodiscover.domain.com and mail.domain.com. This new cert was successfully applied, but whenever someones opens their e-mail they get a warning
about the name on the server not matching the cert. I
I'm pretty sure this is juts a few DNS records I need to update but I don't know which ones and really need some guidance.
Thanks for your time.

So what you are saying is that his current DNS for company.com (which his internal users use for external access) needs to be duplicated internally, then modified to support his internal email access? I've set up many systems where internal DNS and
external DNS hosted the same name, and it is far from simple as "a new zone takes less than a minute to create". How do you handle internal access to external sites (which is currently working just fine with his external DNS)?
To answer your question, my recommendation is that his internal clients use AutoDiscover to gain their internal settings. Keep in mind that while the Exchange server may be in the .local domain, the SMTP domain they host is a .com domain. And since his servers
are in a domain, any domain-attached Outlook client will be able to access the mailbox successfully.
Just create a new DNS record pointing to the external host. Or get a new domain name that doesn't have external websites, then create a new DNS zone for that.
Alright, so with your recommendation - he updates his clients to use Autodiscover, which they are likely already using, to gain internal settings. And then what do you configure the internal URLs as?
For example - Autodiscover.
You set the AutoDiscoverServiceInternalURI to servername.domain.local -> he still gets a cert prompt every time he opens Outlook.
You set the AutoDiscoverServiceInternalURI to mail.domain.com to match the certificate -> Now ALL autodiscover requests from all clients are going out to the internet, then back into the Public VIP.
Same with EWS. And this is assuming he's using RPC/TCP rather than HTTP. So then he's either going to get prompts for cert every time he opens outlook and checks OOF or mailtips, or all internal clients are going to use the external VIP for Autodiscover
and EWS.

Similar Messages

RDS - .local domain and external users. Best way to get rid of SSL warnings

I am evaluating MS RDS as a possible solution for a VDI implementation at the college I work for. When we setup our AD years ago we set it up as a .local domain. I am running into issues with the .local machine name on the connection broker for
external users. I know for internal domain systems we can setup the self signed .local cert as a trusted root cert to bypass the self signed untrusted warning but for the bulk of our users which will be using systems external to our domain they
will get the SSL warning about the self signed certificate when they try to connect to a remote app or a desktop.
Initially I thought if I setup a local AD CA that we could setup a trust relationship with the SSL cert. After further reading I believe that this would only work for systems internal to our domain and we would still have the issue with external devices.
The other option would be to tell our users to click the box to never display the warning message again and to go on or to add the self signed cert to their trusted list. Of course when ever you ask the user to do something there will be issues. We
have also found that in our testing that we can not seem to connect via the web portal with a macbook. We get an error that there is a problem with the trust relationship with the server after we login and click on an app or a desktop to connect. We
have been able to connect with iOS devices.
We could of course rename the .local domain to a .edu domain which would permit us to use our wildcard certificate but that is a major undertaking that we don't want to cross at the moment. I think I might have some up with a solution and wanted to
bounce the idea off of those on this forum.
If we setup a second domain on campus that is not a .local. Join the non internet facing RDS systems to this new domain that would have a SSL cert that was trusted and then setup a full trust relationship between the two domains such that users and
systems in one domain could communicate with the systems in the other domain would that remove the certificate warnings for external users?

Hi AKlein,
Initially I thought if I setup a local AD CA that we could setup a trust relationship with the SSL cert. After further reading I believe that this would only work for systems internal to our domain and we would
still have the issue with external devices.
Just add the root CA certificate of the internal CA into Trusted Root Certification Authorities store on external clients manually (or through group policy if there is an external domain), then SSL certificate warning would be gone.
We could of course rename the .local domain to a .edu domain which would permit us to use our wildcard certificate but that is a major undertaking that we don't want to cross at the moment.
Yes, renaming domain is not recommended due to its complexity.
If we setup a second domain on campus that is not a .local. Join the non internet facing RDS systems to this new domain that would have a SSL cert that was trusted and then setup a full trust relationship between
the two domains such that users and systems in one domain could communicate with the systems in the other domain would that remove the certificate warnings for external users?
If you are setting up a new domain with two way trust, then root CA certificate of the internal CA still needs to be distributed manually (or through group policy). If you are setting up a child domain, then enterprise CA would be trusted within the same
forest.
As long as there are enough external users and devices to manage, an external private network exists and extra domain management tasks are acceptable, then setting up a new domain is a good choice since domain provides secure boundary.
Or, you could just create a new site from the other network location, which saves you from creating a new domain, new users and trust.
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]

Domain and Browser Issues

My wife recently developed a website for her art gallery using iWeb. We upload the website using the mobileme client - which uploaded the website with no problems. A couple of days later we purchased a domain: www.intensebluegallery.com and would like to use that exclusively for the site.
Strangely, we can get to her website www.intensebluegallery through the Safari browser - but we're unable to get to the website using Internet Explorer.
Is there something we need to fix? Can anyone help? Thanks a million!

Welcome to the Apple Discussions.
but we're unable to get to the website using Internet Explorer.
What do you get when you try to load your site in IE? Does it just lock up?
IE is notoriously bad when it comes to adhering to web standards for code, etc. and iWeb sticks to them very closely. One of the issues with IE and iWeb sites is the navbar. It is javascript based. One of the suggestions to make iWeb more compatible with IE is to hide the iWeb navbar and create your own Text Based Navbar. However, it can be a pain to update every page if you add a page to the site.
One of our more experienced users here, Roddy, uses Web Site Maestro to optimize his files before uploading to the server. It can reduce a page's size by nearly 40 percent in some cases which is a big help with IE. IE will freeze if a page has a lot of images on it. I've started using it with some of my sites on MobileMe and it will optimize the files and upload only those that have been changed or added.
Look for some of Roddy's posts about Web Site Maestro or about Internet Explorer to get more info on the subject.
OT

Certificate for sites & .local domain...

Running Exchange on a 2008 Small business server.
My SSL certificate recently expired & when renewing it, I found that I could no longer have an entry for sites or mydomain.local, unless I went with a 1 year certificate, but was also told next year that option was going away all together.
Currently, users are getting warnings when opening outlook. Email is working fine, it's just kind of annoying & I'd like to fix it.
What would be the easiest way to fix this?
Thanks!

Very True!
From Oct 2015, all CAs stop issuing ssl certificate for .local domain names and hostname (NetBIOS names). As per CAB forum regulations this change should be followed compulsory by all Certificate Authorities.
Work around: For now purchase 1 year SAN/UC certificate and this will keep all your local domains secure. M/w you should change exchange server configuration to stop local domains and hostname. Also you should update all exchange email users to update remote
server connection hostname like mail.yourdomain.tld

Virtual Domains and Aliases - the sequel

Ok pterobyte
I have successfully set up virtual domains and aliases on several systems including Mac OS 10.4 - now i'm trying to set up a brand new xserve to host a local domain and several virtual domains...
I have followed pterobytes method of creating virtual domains and aliases etc. However, whether I use /etc/postfix/aliases (for local users) or /etc/postfix/virtual for virtual users - I cannot get the mail to go to two addresses at the same time.
The mail.log only records the mail being sent to local mail box.
Here's an example:
local user example (remote.com is a remote domain where mail should be forwarded to as well as sent to local mail box.)
#aliases
local_guy [email protected], [email protected]
virtual user example
#virtual
[email protected] virtual_guy, [email protected]
"virtual.com" is set up as a virtual domain in SA Mail and mail.virtual.com is that users mail server in WGM.
BTW in pterobyte's latest pdf manual shortname 3 says "shortname3-x: aliases for e-mail address under shortname2" what does that mean?
As I said mail delievers correctly locally but does NOT go to the remote address. Does anyone have a clue what else I can look at?
anyone?
anyone?
Pterobyte?
PowerBook G4, MacBook, various servers Mac OS X (10.4.3)

sorry I missed the colon in the posted message:
it is local_guy: [email protected], [email protected]
Here's the postconf -n (I restored the aliases file back to default last night - i've been working on the virtual forward.)
Thans for getting back so fast...
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
debugpeerlevel = 2
enableserveroptions = yes
html_directory = no
inet_interfaces = all
mail_owner = postfix
mailboxsizelimit = 0
mailbox_transport = cyrus
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
mapsrbldomains =
messagesizelimit = 52428800
mydestination = $myhostname,localhost.$mydomain,localhost
mydomain = iplanitonline.com
mydomain_fallback = localhost
myhostname = mail.iplanitonline.com
mynetworks_style = host
newaliases_path = /usr/bin/newaliases
queue_directory = /private/var/spool/postfix
readme_directory = /usr/share/doc/postfix
sample_directory = /usr/share/doc/postfix/examples
sendmail_path = /usr/sbin/sendmail
setgid_group = postdrop
smtpdclientrestrictions = permit_mynetworks rejectrblclient sbl-xbl.spamhaus.org rejectrblclient relays.ordb.org permit
smtpdpw_server_securityoptions = cram-md5,login,plain
smtpdrecipientrestrictions = permitsasl_authenticated,permit_mynetworks,reject_unauthdestination,permit
smtpdsasl_authenable = yes
smtpdtls_keyfile =
smtpduse_pwserver = yes
unknownlocal_recipient_rejectcode = 550
virtualmailboxdomains = hash:/etc/postfix/virtual_domains
virtual_transport = lmtp:unix:/var/imap/socket/lmtp
MacBook (BootCamp), various Macs and servers Mac OS X (10.4.7)

Virtual domains and their installation

Hello again Alex,
and anyone else able to enlighten me.
Thank you all for your help the last time I was in need.
I'm setting up Postfix by editing the postfix files directly without using server admin due to it's limitations. Especially since I'm using an external GW in a DMZ along with an internal server delivering the mail.
And now I would like to add virtual domains using "Postfix virtual MAILBOX example: separate domains, non-UNIX accounts". Is this possible with OS X?
I have read what is on postfix.org, I have read what is in Alex's installation guide but there are a few things I'm not getting.
I've created the virtual domains and all that stuff but I'm not getting the creation of user access. Do you mean I actually need to create each and every user acessing mail in Workgroup manager?
Could you point me to some information that bypasses the use of server admin but is still usefull in setting up mail under OS X. I don't want to use SA since I do not want to ruin my manual setup of the Postfix files.
Kind regards
Hans

Are you then saying it would be easier to define the
users in workgroup manager and use a couple of
aliases for each user acessing mail?
Definitely easier, but with the limitations you already know.
Is it possible, using this method to use names like
[email protected], [email protected] etc. rather than
[email protected], [email protected] etc.
Sure, just follow my tutorial.
And when
logging into the mailservice do I then have to use
the full [email protected] as a user login name to
access the virtual mailboxes?
Yes, full name with domain.
And is it correct to assume that when using the
server for more than one domain I need to define the
first as a local domain and the rest as virtual
domains?
Yes (if you want to have "hans" as a different user in each domain).
Alex
P.S. Just make a backup fo main.cf so you can copy paste changes that might get hosed by Server Admin. Once your setup is complete, adding users through WGM or aliases through /etc/postfix/virtual will not touch main.cf

Virtual Mail Domains and Email Client setup...

Hello,
I have read the Apple Mail Services pdf and I have read petrobytes pdf on virtual user setup and I now have it working.
The question I have is if I have a virtual domain called vdom1.com and a local domain called ldom.com and I have a user called "user1" in each of these should I not be able to to use "user1" as the username in a mail client config? It won't let me and I would really rather not give out usernames that look like vdom1user1, if at all possible?
Thanks,
tom

Well, obviously you haven't read my tutorial properly
11. - What do my users need to know?
"Username: user1 and password will not work or fetch the wrong
mailbox (unless the user is a local domain user). For virtual
domain users, [email protected] and password is the
way to go."
Use user1 for the local domains and [email protected] for the virtual domain.
Alex

Rejecting Unauthenticated mail from local domains

Hi,
My users connect to my mail gateway to relay their mails using SMTP AUTH. This is working fine.
Now, i want to make sure that when I see From: header containing my local domain and SMTP AUTH is not used, i want to reject the mail.
I am thinking the following line would do it if added to FROM_ACCESS section of my MAPPINGS on gateway. I want to be certain before I test this as I will have to test this during a downtime and my duration would be rather short. Please help.
FROM _ACCESS
*|SMTP|*|tcp_local|*+*@mydomain.co.in| $Y
*|SMTP|*|tcp_local|*|$2* $Y
*|SMTP|*|tcp_local|*+*@*|$2*@$4* $Y
*|SMTP|*|tcp_local|*|* $Y$K$3
Will this do the job? I am running 5.2sp2

Sorry..that was wrong...here it is..
FROM _ACCESS
*|SMTP|*|tcp_local|*+*@mydomain.co.in| $NLogin$ to$ send$ mail
*|SMTP|*|tcp_local|*|$2* $Y
*|SMTP|*|tcp_local|*+*@*|$2*@$4* $Y
*|SMTP|*|tcp_local|*|* $Y$K$3

Local domain, IIS Hosting and SMTP issues.

I have a local domain on Windows server 2012 with dns, dhcp, iis and smtp. (Yes, I am aware of the dangers of these combinations) it is for learning purposes only and not my main pc.
My local domain is willow.run and I am hosting a website, the domain for that is machinerylubricant.com I have IIS 8 installed (6.0 also for smtp)
My original issue was getting IIS to send an email to localhost through a php script for a contact form hosted on the website. I finally got to where it appears to be sending the contact form info to my drop folder but I ahve no idea how to get that .EML
file to actually forward to gmail account or even outlook on my computer/server.
In the email file (.eml in drop folder) it says "To: *******@gmail.com" as it is supposed to but that email is not making it to the specified gmail account. Also no error messages in the ph logs or the log files for smtp. How would I go about setting
up a email program to work on the lan with the acual www domain name I own?
I am learning everything at once basically, windows server, coding, protocols etc. Please bare with me.

Rather than answer your specific question, how about I give you the best way to achieve what you're looking for?
For inbound messages, you want to use the "aliasdetourhost" keyword. Check the documentation for how this is set up.
For outbound messages, you want to use the "alternate conversion channel"
When used together, this will achieve what you're looking for, without the looping that you have generated....
The alternate conversion channel was written up here:
http://ims.balius.com/resources/downloads/files/AlternateConversion.pdf

"Setup encountered a problem while validating the state of Active Directory: Exchange organization-level objects have not been created, and setup cannot create them because the local computer is not in the same domain and site as the schema master. Run se

Team,
I am trying to Install Exchange on my Lab, getting below error
message.
The Schema Role is installed on Root Domain and trying to install
exchange on Child domain.
1 Root Domain - 1 Child domain. both are located on single site.
“Setup encountered a problem while validating
the state of Active Directory: Exchange organization-level objects have not been created, and setup cannot create them because the local computer is not in the same domain and site as the schema master. Run setup with the /prepareAD parameter and wait for
replication to complete.”
Followed below articles:
http://support.risualblogs.com/blog/2012/02/21/exchange-2010-sp2-upgrade-issue-exchange-organization-level-objects-have-not-been-created-and-setup-cannot-create-them-because-the-local-computer-is-not-in-the-same-domain-and-site-as-the-sche/
http://www.petenetlive.com/KB/Article/0000793.htm
transferred the schema roles to different server on root domain, still no luck.
can someone please help me.
regards
Srinivasa k
Srinivasa K

Hi Srinivasa,
I guess, you didn't completed the initial setup schemaprep and adprep before starting the installation. You can do it as follows:
1. Open command Prompt as administrator and browse to the root of installation cd and run Setup.exe /PrepareSchema /IAcceptExchangeServerLicenseTerms
After finishing this,
2. Setup.exe /PrepareAD /OrganizationName:"<organization name>" /IAcceptExchangeServerLicenseTerms
3. To prepare all domains within the forest run Setup.exe /PrepareAllDomains /IAcceptExchangeServerLicenseTerms. If you want to prepare a specific domain run Setup.exe /PrepareDomain:<FQDN of the domain you want to prepare> /IAcceptExchangeServerLicenseTerms
4. Once you complete all of the 3 steps, install the pre-requisities for Exchange 2013
5. Finally, run the setup program
Hope this will help you
Regards from Visit ExchangeOnline |
Visit WindowsAdmin

VALN locally assigned and VTP prunning and Domain

I have got this scenario like this
Switch1:
vtp domain DOGCAT
vtp password CISCO
vtp pruning
vlan 3,5,6,8,10,26,33,52
Switch2:
vtp domain DOGCAT
vtp mode client
vtp password
Requirement:
VLANs not locally assigned should not be received over any trunk links throughout the VTP domain.
Explanation:
By default, all VLANs are allowed to be sent over any trunk link in the VTP domain. Therefore, broadcast frames and frames destined for unknown unicast addresses will be sent over all trunks throughout the domain. This behavior is undesirable when one or more switches throughout the VTP domain receive traffic for VLANs that they do not have locally assigned and are not in the transit path for.
In order reduce this unnecessary traffic VTP offers a feature known as pruning.
VTP pruning allows a switch to communicate with its directly connected
neighbors about what VLANs they have locally assigned and are in the transit path for.
Therefore VLANs that are unnecessary can be pruned off of the
interface. VTP pruning can be enabled by issuing the vlan database or global
configuration command vtp pruning.
I am looking to understand the concept of :
1- Can we consider vlan (3,5,6,8,10,26,33,52) locally ? If so why do we consider them localy,,,do we consider them locally because we define them under vlan command in global configuration ? or becaues they are in the same domain (DOGCAT) ?
2- ",,,, frames destined for unknown unicast addresses,,," ?!
3- " transit path for" ?

Hello,
I think your confusion might come from the term ´locally assigned´. To clarify this, conssider the following scenario:
You have 3 switches, Switch1, Switch2, and Switch3. All 3 switches are in the same VTP domain, so the configuration would look like this:
Switch1
vtp mode server
vtp domain CISCO
vtp password cisco
vlan 3,5,6,8,10,26,33,52
Switch2
vtp mode client
vtp domain CISCO
vtp password cisco
Switch3
vtp mode client
vtp domain CISCO
vtp password cisco
Now assume Switch2 and Switch3 are each connected to Switch1 by a trunk link.
VLANs can only be created on the VTP server, Switch1 in this case. The VLANs created on Switch1 are all propagated to Switch2 and Switch3, regardless of wether there is a port on those switches in up/up state assigned to one of those VLANs. Let´s say Switch2 has all ports assigned to VLAN 6 (that is, all ports are configured as following):
interface FastEthernet0/1
switchport access vlan 6
In this case, there would be no real need for all the other VLANs to be propagated to Switch2, because the only VLAN it needs is VLAN 6. This is where VTP Pruning becomes helpful. You enable it globally on the VTP server (Switch1 in this case), and all trunk links are checked for which VLANs are needed at the other end of the trunk connections, which are Switch2 and Switch3.
With regard to your specific question: VLANs 3,5,6,8,10,26,33,52 will be pruned if there are no ports assigned to those VLANs on the client switches (as stated in the example above). As a matter of fact, you cannot even create the VLANs on Swicth2 or Switch3, since they are in VTP client mode.
The only way Switch2 and Switch3 would be able to get the VLANS anyway is when they are configured as VTP servers as well. That might actually be your problem: the default VTP mode is server, that is why you can create VLANs and enable vtp pruning globally. Keep in mind that the VTP server always has the entire VLAN database, and that nothing is pruned off links between VTP servers...
Does that make sense ? Let me know if you still have doubts about the concept...
Regards,
GP

I am having issues with my web module on Lightroom 4 (Mac OS 10.9.5). "an unknown error occurred" while trying to upload to my FTP (no changes in my FTP). Bandaid fix was to export to local folder and upload via Filezilla. However, now that is no longer w

I am having issues with my web module on Lightroom 4 (Mac OS 10.9.5). "an unknown error occurred" while trying to upload to my FTP (no changes in my FTP). Bandaid fix was to export to local folder and upload via Filezilla. However, now that is no longer working and although upload completes, the URL takes you to a "Forbidden - do not have permission to read this file" page. Lightroom is changing the permissions of each file to 000 instead of 644 for index files and 755 for all others. How can I change the permissions settings in Lightroom?

I am having issues with my web module on Lightroom 4 (Mac OS 10.9.5). "an unknown error occurred" while trying to upload to my FTP (no changes in my FTP). Bandaid fix was to export to local folder and upload via Filezilla. However, now that is no longer working and although upload completes, the URL takes you to a "Forbidden - do not have permission to read this file" page. Lightroom is changing the permissions of each file to 000 instead of 644 for index files and 755 for all others. How can I change the permissions settings in Lightroom?

Resolving local domain name and nameserver address

Hi,
Is there any way to get the local domain name (on Windows it would be NT domain name and on Unix based platform it is DNS server's domain name) and local DNS server address ?
Thanks,
Rohit

import java.net.*;
try
   InetAddress ip = InetAddress.getLocalHost();
   String fqdn = InetAddress.getCanonicalHostName();
   int firstDot = fqdn.indexOf(".");
   String domain = fqdn.substring(firstDot+1);
   System.out.println("domain: "+domain);
catch(Exception ex)
   ex.printStackTrace();
}

Cs5 "local disc" and .js path issues

Trying to add what appears to be a simple .js script to my doc:
I add the script to my <head>, which then shows next to my Source Code and other scripts. But it doesn't work, and when I click to open the file there, I get the message 'not on local disc', and 'Get' which doesn't work either, even though the file is in my local file view/f8. One would think when the script name pops up next to Source Code, the doc. path is correct, but that obviously isn't the case. So what is the deal with this 'local disc'?
I added a clearbox last week after pulling my hair out over the similar path issues, and after much trial and trib it finally worked. Would rather just like to understand it. Can anyone help? Thank you.
The .js' Column' script I'm trying to add is here if it helps: http://www.projectseven.com/tutorials/css/pvii_columns/index.htm

I also would like to know how to do this!

Edge Inspect - IIS local domains issue

Hi,
I am a Windows 7 user and I'm currently checking if Adobe Edge Inspect is a tool we can use at our company.
We run .NET projects and use IIS for local domains.
When we use Edge Inspect on mobile devices the websites won't show.
The domains are listed in the hosts file, for example: 127.0.0.1 2012.companyname.local
I saw the posts about xip.io and charles proxy but all the info in these discussions is Mac OSX based.
Is there any support for Win users?
gr,
Peter

I work on a Windows machine and have successfully used both Charles Proxy and xip.io to reach local domains defined in my hosts file. I use WAMP server though, so the difference for you might be IIS.
You've seen our blog posts on this topic?
http://blogs.adobe.com/edgeinspect/2012/06/19/shadow-xip-io-virtual-hosts-workflow-simplif ied/
http://blogs.adobe.com/edgeinspect/2012/05/16/shadow-charles-proxy-virtual-hosts-workflow/
I think those instructions work for both Mac and Win.
Can you tell me what the full URL you're putting into Chrome is?
Can your devices reach your pages by using your machine's IP address (shown at the top of the Chrome extension dialog) instead of the local domain?

.local domain and autodiscover issues

Similar Messages

Maybe you are looking for