Netbios names on exchange certificates

Hi,
Is it not best practice to include the server netbios name in the SAN on the Exch 2013 SSL cert? Also is it even supported as I see some suggestions that netbios names on exchange certs is not often supported by online certificate authorities.
Thanks

Hello,
Since the certificate SAN name can be seen by public. If any security issues are not cared, it’s fine to add it to the SAN name.
More information and best practices for Exchange Certificate in:
Digital Certificates and SSL
http://technet.microsoft.com/en-us/library/dd351044(v=exchg.150).aspx
Thanks,
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Simon Wu
TechNet Community Support

Similar Messages

Remove Netbios Name in Exchange Server 2013 Password Change Page

Hi,
I have multi-tenant environment in my exchange server 2013. The problem is that when every user want to change password, default NetBIOS name of Exchange Server appears and greyed on the page.
Domain\user name:
I need to show domain of every user in the Domain\ field
Is there any solution?
Any help in this regard will be highly appreciated.

Hi,
How about select "user name only" and specify the logon domain?
The following screenshot for you reference:
Hope this helps!
Thanks.
Niko Cheng
TechNet Community Support

Trouble with DNS/NetBIOS name resolution over VPN

I’ve got one for the DNS/WINS gurus out there who are also familiar with VPN connections.
We have a VPN setup on our Mikrotik RouterBoard 532 for a number of employees running Windows 7 Pro laptops. Unfortunately the Mikrotik is maintained by our ISP so I don’t have access to it, but I can call them to make changes. Anyhow, I do not believe it
is a problem with the Mikrotik.
The problem is with resolving NetBIOS names (UNC paths, drive letters, etc…) over the VPN from remote locations, and ONLY with laptops joined to our
abc.local domain. If I use my home PC or disjoin the domain laptop from the
abc.local domain and return it to WORKGROUP, keeping the same Windows VPN client settings, I am able to resolve paths just fine.
For example, when I type \\server1 from Start>Run, it fails and tells me “server1 is not accessible. You might not have permission to use this network resource.” Using the FQDN is no problem at all, which makes me believe the problem is with NetBIOS resolution
and takes me to the WINS servers on the network.
The VPN hands out primary and secondary WINS servers, and they appear to be configured correctly in our Server 2003/2008/2012 environment. When I run
nbtstat –A IPAddressOfLaptop from a WINS server it resolves the laptop, and the same command from the laptop looking to the server resolves OK too.
What’s strange is that when I ping “server1” I get a valid response from server1.abc.local, as expected, but for some reason I still can’t browse to it from start>Run… “\\server1”.
The DNS suffix abc.local is in the “DNS suffix or this connection” field in the properties of the VPN client since the Mikrotik VPN is unable to deal this to clients.
I have ruled out Group Policy as the culprit because even after removing any group policy from applying to one of the laptops the result was the same.
I’ve used every resource and tool that I could to try and find where the problem lies and can’t seem to solve it. Everything looks properly configured.
I would greatly appreciate some assistance!

When you run an ipconfig /all, do you see the WINS server addresses being provided? How about the connection specific suffix for the domain, domain.local (or whatever it is called)?
I assume that you are using the Microtik as the VPN server and you are not using AD accounts for authentication. I would highly suggest to do that, otherwise, there will be a mismatch.
What VPN client is being used?
What is offering DHCP, a Windows Server or the Microtik?
FYI, using NetBIOS connection method, such as \\server1, will use the current logged on account for authentication. If the VPN credentials are not AD credentials, but the VPN client is setting the logged on credentials account
(some of them do that), then it will cause issues.
From what I see that NetBIOS is not being blocked, so that doesn't appear to be an issue, but it's coming down to credentials. Maybe in the mapped drive you can preset the credentials, and might be one way around it.
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/
This post is provided AS-IS with no warranties or guarantees and confers no rights.

10.4.6 update broke my Exchange certificate?????

Everything was working fine on my PowerMac G4 dual processor until I installed the 10.4.6 updater that was posted yesterday. Now, when I try to run Entourage 11.2.3, I get an error message that the root certificate does not exist.
However, when I go into keychain access, I find that the root certificate is, in fact, there. In both instances, keychain access says the certificate is valid, but no matter what I try, Entourage doesn't recognize its validity.
And this problem is not limited to Entourage. When I try collecting my exchange mail using the web client, Safari says the certificate is not valid. What's worse, I cannot tell it to always allow. No matter whether I check the box to always allow at the top of the certificate display or even go into the individual certificate security settings and set to always allow, every time I run Safari, it notifies me that the certificate is not valid.
I have already tried repairing permissions (which has gotten very, very quiet since the update to 10.4.6 - no more "we are using special permissions for xxx.widget" over and over again) and repairing through keychain first aid many times. Multiple re-starts has not resolved the issue.
What did 10.4.6 do to my certificate, and how can I fix it???

Hello Brad.
I've not had the courage for 10.4.6 yet, but am on 10.4.5 with Entourage/Exchange. I therefore have no specific result for you other than to say I had a challenge that Entourage constantly telling me that the root certificate wasn't installed... I followed the MS help proceedure of installing the root certificate to no avail. I wasn't until I changed the name of the exchange certifcate in the path of the exchange it was looking for did it no longer complain (in Account prefs of Entourage).
Specifically:
if your Exchange is called mailserver.domain.com, but your certificate has a name of exchange.domain.com, then change the path in Entourage to the latter... also remember to change the Public Folder lookup path to exchange.domain.com/Public.
It occured to me then, that the installation of the root certificate was an irrelevance??
HTH
Let me know how you get on, I'll also check some MS sites.
Cheers
iMac 1.9GHz 1.5Gb RAM 17" Mac OS X (10.4.4)
iMac 1.9GHz 1.5Gb RAM 17" Mac OS X (10.4.4)
iMac 1.9GHz 1.5Gb RAM 17" Mac OS X (10.4.4)

Checklist for Exchange Certificate issues

Checklist for Exchange Certificate issues
1.
Why certificate is important for Exchange and What are Certificates used for
Exchange is now using certificates for more than just web, POP3, or IMAP. In addition to
securing web services, it has also incorporated Transport Layer Security (TLS) for session based authentication and encryption.
Certificates are used for several things on Exchange Server. Most customers also use certificates
on more than one Exchange server. In general, the fewer certificates you have, the easier certificate management becomes.
IIS (OWA, ECP, EWS, EAS, OA, Autodiscover, OAB, UM)
POP/IMAP
SMTP
2.
Common symptoms for
certificate issue
Here we can see three different types of the certificate warning, mainly from the Outlook
side.
a.
Certificate mismatch issue
b.
Certificate trust issue
c.
Certificate expiration issue
3.
Checklists
In this section, checklists will be provided according to the three different scenarios:
Certificate Mismatch Issue
[Analysis]:
This issue mainly occurs because the URL of the web services Outlook tries
to connect does not match the host name in the certificate.
[Checklist]:
Firstly make sure how many host name in your certificate the certificate. Run “Get-ExchangeCertificate | select certificatedomain”.
Secondly, check the web services URLs which Outlook are trying to connect to. Run “Test Email AutoConfiguration”
In this scenario, you need to check the host name for the following services:
Autodiscover
EWS
OAB
ECP
UM
If any of the urls above does not match the one in the certificate, refer to the following article to change
it via EMS:
http://support.microsoft.com/kb/940726
1.
Do not forget to restart the IIS service after applying the changes above.
2. Make sure a valid certificate is enabled on the IIS service.
Certificate Trust Issue
[Analysis]:
For the self-signed and PKI-based (Enterprise)
certificates, they are not automatically trusted by the client computer or mobile device, you must make sure that you import the certificate into the trusted root certificate store on client computers and devices. On the other hand, Third-party or commercial
certificates do not have this problem. Most commercial CA certificates are already trusted because the certificate already resides in the trusted root certificate store. Because the issuer is trusted, the certificate is also trusted. Using third-party certificates
greatly simplifies deployment.
[Checklist]:
If it’s an Enterprise CA certificate, manually install the root certificate to the “Trusted Root Certification Authorities” folder:
If it is a 3<sup>rd</sup>-party certificate, first remove and reinstall the certificate. Check whether the Windows Certificate Store on the local
client is corrupted. If it still does not work, please contact the third-party CA support to verify the certificate.
Certificate Expiration Issue
[Checklist]:
When a certificate is about to expired, we just need to renew it by referring the following article:
Renew an Exchange Certificate
http://technet.microsoft.com/en-us/library/ee332322(v=exchg.141).aspx
To avoid any conflictions, it’s recommended to remove the expired certificate from the certificate store.
[How to set a reminder to alert the administrator when a certificate is about to expired]:
It’s easy to fix the certificate expire issue. But it should be more important to set a reminder before the
certificate expiration. Or there can be a large user impacts.
Generally, the Event ID “^(24|25)$” will appear in Application log when a certificate is about to expire.
If it’s not quite visible, we can refer to the following solution:
http://blogs.technet.com/b/nexthop/archive/2011/11/18/certificate-expiration-alerting.aspx
OWA certificate revoked issue
[Analysis]:
IE
includes support for server certificate revocation which verifies that an issuing
CA has not revoked a server certificate. This feature checks for CryptoAPI revocation when certificate extensions
are present. If the URL for the revocation information is unresponsive, IE cancels the connection.
[Solution or workaround]:
1. Contact CA provider and check whether the questioned certificate is in the Revoked List.
2. If not, check whether the certificate has a private key.
3. Remove the old certificate and import the new one.
Workaround:
IE Internet Options -> Advanced tab -> Clear the "Check for server certificate revocation"
checkbox.
4.
More References
Digital Certificates and SSL
http://technet.microsoft.com/en-us/library/dd351044(v=exchg.150).aspx
More on Exchange 2007 and certificates - with real world scenario
http://blogs.technet.com/b/exchange/archive/2007/07/02/3403301.aspx

(Reported previous post with link to SIS package to moderator)
This is not the correct SIS package for the N73. The package shown is for S60 3.2 devices, but the N73 is not S60 3.2, I believe it is S60 3.0.
Most features may work with this SIS, but if you experience strange problems, try using the S60 3.0 version.
But there are no significant difference between 2.5.3 and 2.5.5 with regard to attachments. The only changes were with localization (languages).
At this point, try 2.7.0 which is out now:
http://businesssoftware.nokia.com/mail_for_exchange_downloads.php
Make sure to pick the right phone on the drop down list. It does matter! There are 4 different packages. This list makes sure you get the right one.
I have seen some issues with attachments not completing that seem to be carrier dependent. You can test this my using Wifi (if possible).
Message Edited by m4e_team_k on 28-Sep-2008 12:25 AM

Change NetBIOS name in 10.6 Server

I'm setting up a new server to replace my PowerMac G5 Leopard server, just got a Mac Pro so I put 10.6 server on there for file sharing services. I cannot figure how to change the NetBIOS name however. When i go into System Prefs and try to change it that way, it points me to Server Admin, but I can't figure out where to change it. It's currently at new-host.local, and I would like to change it to Lambda.local. How do I go about doing this? Thanks

Hi,
We can use the active directory rename tools to rename domain NetBIOS name. But it is a complex and risky process.
For more information about how to use random.exe to rename domain name, please refer to the following article:
Rendom
http://technet.microsoft.com/en-us/library/cc732097.aspx
Besides, renaming of the NetBIOS domain name is not supported in any version of Exchange Server.
For more information about this, the following threads can be referred to.
NetBios Name Change
https://social.technet.microsoft.com/Forums/en-US/2cd9d561-e737-43ee-b791-0501105b85e9/netbios-name-change?forum=winserverDS
Can we change our domain netbios name?
https://social.technet.microsoft.com/forums/windowsserver/en-US/989a8a16-7c8b-4787-8092-605de6b9d617/can-we-change-our-domain-netbios-name-
Best Regards,
Erin

How do i change netbios name in windows 2012 server

Hi,
i have create Ad on windows 2012 server and i have enter netbios name with end 0. now problem is when try to access any user it show netbios name there. is it possible that i can change netbios name or why it show netbios name.
sunit kumar

Hi,
We can use the active directory rename tools to rename domain NetBIOS name. But it is a complex and risky process.
For more information about how to use random.exe to rename domain name, please refer to the following article:
Rendom
http://technet.microsoft.com/en-us/library/cc732097.aspx
Besides, renaming of the NetBIOS domain name is not supported in any version of Exchange Server.
For more information about this, the following threads can be referred to.
NetBios Name Change
https://social.technet.microsoft.com/Forums/en-US/2cd9d561-e737-43ee-b791-0501105b85e9/netbios-name-change?forum=winserverDS
Can we change our domain netbios name?
https://social.technet.microsoft.com/forums/windowsserver/en-US/989a8a16-7c8b-4787-8092-605de6b9d617/can-we-change-our-domain-netbios-name-
Best Regards,
Erin

Netbios name required for Windows 7 clients to connect?

I upgraded my production server to Lion tonight.
My Windows 7 test machines (all standalone -- no AD here) now need to log into the server with the netbios name of the 10.7 server as part of the login:
ie, instead of "maser" as the User Name
it now requires "<netbiosname>\maser" as the User Name
Everything works, but that futz's up the pass-through authentication I had set up for the Win7 users whom I had just set their Windows account/password combination to match the 10.6 server account/password combination.
(smb://<server> from the Mac side doesn't care about the netbios name…)
Any suggestions on what might need to be tweaked in com.apple.smb.server.plist?
- Steve

Hi,
According to the error message: 接收到显式 EAP 失败, you can refer to the KB below to download and install hotfix tool for this problem for test.
Windows 7 does not connect to an IEEE 802.1X-authenticated network if an invalid certificate is installed:
http://support.microsoft.com/kb/2494172/en-us
In addition, another library that teaching about Configure 802.1X Wired Access Clients for EAP-TLS Authentication might be helpful with your problem.
http://technet.microsoft.com/en-us/library/dd759237.aspx
Roger Lu
TechNet Community Support

Lync + Exchange certificate

Hello guys,
I want to go through the PIC provisioning process so that my lync users can communicate with Skype users. I am aware that i need a public certificate for my edge server in order to do this. Right now i have certificates for my Exchange 2013 and Lync 2013
from my internal CA and i want to replace the Lync Edge certificate and the Exchange Certificate with a public one(SAN, i want all the FQDNs on one certificate). I have read other articles on this but i want to be sure so please hear me out.
1) My Lync Edge server has only one external intereface with the FQDN sip.contoso.com. From what i've read i cant use wildcard certificates with this interface, so i must use SANs.
2) My Exchange uses one namespace: mail.contoso.com. Also i need autodiscover.contoso.com for autodiscovery.
So the certificate will look something like:
CN: sip.contoso.com
SAN: mail.contoso.com, autodiscover.contoso.com
Do i need to put sip.contoso.com or anything else in SAN also?
I'm going to test this with an internal certificate before i buy a public one, but i want a second opinion before testing on a production environment.
Thank you

Hi,
I would say , we should include sip.domain.com in certificate SAN entry. Few validation checks will skip subject name and verify SAN in the certificate. Following article may help you ;
http://technet.microsoft.com/en-us/library/gg398519.aspx
Thanks
Saleesh
If answer is helpful, please hit the green arrow on the left, or mark as answer. Blog : http://blogs.technet.com/b/saleesh_nv/

WRT1900AC and its' NETBIOS name...

I have third party backup software that recognizes NETBIOS names and it tells me that my WRT1900AC Router is broadcasting "WORKGROUP" on my local network in addtion to the name my Windows client computers use. I want all my computers/wire connected devices to use the same NETBIOS name when they are talking on my wired network, and to be able to include the disk attached to the router in that network so that things are handled efficiently and consistently by XP, Vista, and Win7 clients. I can't find a way to change it using the web interface I have access to which is the "out of the box" 192.168.0.1/.... address (Which my 64 bit Windows IE 11 based Norton security software thinks has an "expired certificate" even though the firmware is up to date!) I think I used to be able to do it on an older Linksys E3000 that eventually died, but its' support for a USB attached disk was really slow compared to the WRT1900AC's eSata connection, so I did not try to host backups there and went around my network with an eSata enclosure and manually backed up each computer (a **bleep**) but the only way to be efficient. My Ethernet wiring is at 1000 mbps so I am getting reasonable performance now but still having configuration issues....

NO this is happening from within the router itself. Windows (and other OS's) can "see" which workgroups are on the network and will display them, regardless of weather they are accessible (permissions etc)
I have a network consisting of multiple Linux machines on my home network under my own unique workgroup name. I don't have ANY Microsoft or Apple (except "iPhone's") on this network. The only reason I'm running a windows (smb) network and not NFS, is because occasionaly people bring me their Windows machines for repair or upgrade etc, and it's handy to be able to access windows tools I store on my FreeNAS server from the machines I'm working on - It's easy to get Linux talking to propriotry systems, but NOT the other way around (Asan example, as far as I'm aware, Windows can't do NFS.)
So it's like this, I upgraded my router to the new WRT 1900AC, and now, for the first ime ever, I have not only my own unique workgroup name, but also a separate "NEW" workgroup, name d "WORKGROUP" which only the WRT shows up in.
Both of my previous routers were able to be set to "Show Up" on a particular workgroup by changing to that name within the routers settings. But I can't find how/where to do this within the WRT.
The router, whilst responsible for the obvious - routing and network access etc - is still also another network device which can be accessed to a degree from a particular workgroup (provided it''s nmame has been set) ...For example:

Contacts app not finding names in Exchange 2010

Contacts app not finding names in Exchange 2010 server
This is weird, could be a bug in 10.8.2, not sure, want to see if anyone else is seeing this.
Mountain Lion 10.8.2
Exchnage account created for: Mail, Contacts, Calendars. All looks good there.
Cannot lookup names / email addresses in Contacts Global Address List (GAL) or in Mail app.
Can delete the Exchnage account in Contacts and re-add it, and it will work.
Once Contacts quits and is re-luanched, no dice. No connection, just spins and spins.
Eventually Contacts app crashes, (not responding).
Outlook 2011 works just fine, seems an issue with Contacts.
Thanks,
John K

I thinkk this is a bug in Contacts app, 7.1 (1167), in MT Lion.
If one inputs the actual AD domain controllers dns name, for the Internal Server, Contacts app does the lookup successfully and pretty quick.
This is how it is on Outlook 2011 BTW. Directoy Service in OL 2011 is the AD domain controller FQDN, not the Exchnage server.
thanks,
jk

RESOLVED On Premises (intranet use only) Exchange Certificate Help (Please)!

I apologize in advance for what may end up being a very silly issue.
I have racked my brain and read and searched and I still can't seem to find the answer to my question.
I have an in house Exchange server that is only accessible internally. We do not have external clients (laptops/tablets/etc) and all computers stay on premises. Most of our clients use OWA to access email. Everything has been working fine up until about
2 weeks ago when everybody started getting a certificate error. I have tried every thing I can find to fix this issue to no avail. It seems the thumbprint of the certificate is different each time I visit the exchange server (https://exchange/owa). So I can
install the certificate which works for a few minutes and then it prompts me again. When looking at the thumb print of each instance, everything seems to be exactly the same with the exception of the thumbprint.
My first question, is do I still need to go through a CA even though this server is not accessible via external IP?
Where are my clients getting the certificate they are trying to install because they do not match the certificate that is installed on the Exchange Server.
Thank you in advance for anybody that can steer me in the right direction to getting this resolved.
I support this site remotely so any additional info can be provided but there might be a small delay.

First, thank you for taking the time to respond.
"I'm going to assume that you have some sort of PKI infrastructure with in your environment."
I'm not sure I do. This project landed in my lap a few years ago. This particular client is my only client
with exchange. I have limped my way though to this point but I'm afraid I'm just not clear on what it is I actually need.
We are running Exchange 2013 on a Server 2008 box. Everything worked fine up until about 2 weeks ago. I have no idea what changed.
I think my biggest problem is my lack of understanding of where the client is pulling the certificate when I access the intranet site. I don't understand why the certificate (whether valid or not) isn't matching the certificate within IIS/Exchange admin.
Hi,
I think you can check your certificate information and provide the information here for more help. Please run the following command in Exchange Management Shell:
Get-ExchangeCertificate | fl
Additionally, since the certificate issue occurs when accessing Exchange server from OWA, please check the OWA configuration in your Exchange:
Get-OwaVirtualDirectory | FL Identity,*Authentication*,*url*
Generally, the namespace used in the OWA URL should be included in the Exchange certificate which is assigned with IIS service.
Regards,
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Winnie Liang
TechNet Community Support

NetBIOS name in shared column?

Can anyone explain why my G5's NetBIOS name (WINS) shows up on the shared column when I am logged on to my powerbook or IMAC (both wireless)? The G5 is connected to the Airport Extreme via ethernet.
Just updated several days ago to 10.5.1 and this just started the other day. Annoying to see that odd name there in the finder window under shared....
Must have something to do with the ethernet since this does not ocur with the wireless computers

My flat mate's Mac mini also shows its netbios name on the network when viewing from my iMac. Can't seem to find out how to get it to go away! Mine does not however show up on his. We both have AFP and SMB enabled.

Common Name on SSL certificate

I was wondering if anyone can tell me whether the Common Name on the SSL certificate (which I plan to request from Verisign) MUST be the same as the name of the Sun One 6.0 SP6 web server instance.
For example, if my server name in the Servers tab is "svr9999.mycompany.com" but I have a DNS alias giving the machine the name "www.mycompany.com", can I use the "www.mycompany.com" name for the certificate, or does is have to be the actual "svr9999.mycompany.com" name in the Server tab?
If that is possible, is there any "special" stuff I need to do to accomplish it?

Yes, I found today that it worked fine to make the Common Name on the certificate be the DNS name I want the world to use (even though it differed from the internal name of the server instance).

Changing NetBios Name & Changing Workgroup

Hello,
I every time i try to change the NetBios name or type in a new Network group leopard dosen't save the changes! can anyone help?
Airport > Extra Options > WinMenue

Try hitting "Enter" after you add the new workgroup name.
Peter

Netbios names on exchange certificates

Similar Messages

Maybe you are looking for