Server essentials 2012 uses wrong certificate for Exchange OWA

I have two servers (Essentials 2012 and Exchange 2013) behind a firewall. port 443 is routed to essentials.
I have set up arrconfig following TechNet jj200172 (in fact I followed this link closely for the entire setup).
Our client has a single external static ip & two certificates (godaddy) . I’ll call them arr.help.ca   and mail.help.ca
On the lan, I has split dns so that Outlook trying to reach "http mail.help.ca" gets the local ip. In fact all is working fine on the Lan.
From the WAN  "https arr.help.ca"   present the essentials web page, with desktop and shared folders working fine, but...
From the Wan   "https mail.help.ca/owa"   presents the owa logon page, but also the browser warning that the cert is incorrect.
The problem is the cert presented is arr.help.ca, not mail.help.ca
     The cert chain is fine (i.e. the godadddy intermediate cert is trusted),
       both certs are not expired,
       the cert subjects are correct.
Any idea's on how to troubleshoot this?

Hi Rick,
Did you use the
Microsoft Remote Connectivity Analyzer Tool to check if there has any connectivity issue firstly? Meanwhile, please refer to following Robert’s article and check if can help you.
On
Premises Exchange Integration Windows Server 2012 Essentials
If any update, please feel free to let me know.
Hope this helps.
Best regards,
Justin Gu
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Similar Messages

Use ssl certificate for Exchange Account

Hello everyone!
I have some problem with Exchange instance and iphones.
I have Front server with client authentication via ssl certificates. How i can use this certificate on iphone to connect iphone to exchanges account?
After few hours of googling i find only one solution here - http://www.msexchange.org/articles-tutorials/exchange-server-2010/mobility-clien t-access/configuring-certificate-based-authentication-exchange-2010-activesync-p art2.html
In few words - it can be done with iPhone Configuration Utility
Does this ONLY solution or i can import ssl cert directly to iphone?
Thanks a lot for any help

Hi bb9193, this will not be no short-term solution, but you might consider using a MDM-solution. With MDM it is possible to deinstall and reinstall the Exchange profile over the air, so your users will not need to do more than just reenter their Exchange password.
Best regards,
Detlev

Mail uses wrong certificate for encrypting S/MIME messages

Encrypted email I send using Mail Version 4.2 (1077) under OS X 10.6.2 to my work account cannot be decrypted. It appears that Mail is using the signing certificate, rather than the encryption certificate, to encrypt the email.
The internal Certificate Authority at my employer has issued two certificates to me: A signing and an encryption certificate. Both certificates are properly stored in my keychain.
The encryption certificate carries a 0x20 in the key usage field to designate the certificate to be used for encipherment purposes. The signing certificate carries a 0x80 in the key usage field to designate the certificate to be used for digital signatures.
I understand that the S/MIME standard stipulates that for encrypting messages, the certificate with 0x20 in the key usage field should be used by the mail application.
However, messages I sent are encrypted using the signing certificate (0x80 in the key usage field) and therefore cannot be decrypted on the receiving end. I examined the encrypted email using an [application|http://www.eriugena.org/blog/?p=57] to extract the serial number of the certificate used for encryption.
We are using Outlook 2003 as our mail application at work.
Has anybody ever come across this problem? Am I missing something - is there a way to tell Mail what certificate to use for encryption?
Thanks,
-Michael.

I'm have a problem that sounds related.
Both my wife and I created self signed mail certificates, and sent email to each other and trusted each others certificates. We were then able to send encrypted emails back and forth and our emails showed up as having trusted digital signatures.
Then, we both purchased Verisign email certificates, and installed them in our keychains, deleting the old self-signed certificates, and repeated the process of establishing a chain of trust.
This worked fine for me running Snow Leopard but did not work for her on Leopard. Her emails to me appear to be signed by both the old self-signed certificate and to include the new verisign certificate. Looking at the message source there is only one application/pkcs7-signature block, but in the UI it is showing both certificates.
I don't understand how the self-signed certificate is showing up at all, since it has been deleted from her keychain.

Best practices for upgrading Windows Server Essentials 2012 to R2?

Hi,
I need to upgrade my Windows Server Essentials 2012 on an HP microserver to Essentials R2 (specifically the R2 role on Standard rather than as a VM). After a reasonable amount of searching, I haven't found anything online that specifically addresses this in-place
upgrade scenario. Since this is already an Essentials server, it's the PDC in its own domain, etc. Has anyone that's done this upgrade have any experiences or warnings to share?
Thanks,
Sean

Hello there,
There is no upgrade path from Server 2012 Essentials to R2. R2 is not an upgrade, it is a new build. Essentials does not upgrade easily, you will want to perform a migration of the server. This will require additional hardware. You
can possibly backup the 2012 Essentials, build a temp server on workstation hardware just to do the migration from, restore the backup to the new server and then perform the migration to R2.

Cannot setup VPN (WMI failure?) - Server Essentials 2012 R2

Hi,
Last week i setup a new Server Essentials 2012 R2 (fresh install). Everything apart from the Anywhere Access has sucessfully been setup and the server is in a production Environment.
When i try to configure Anywhere Access and setup VPN + RemoteDesktop , the wizard fails. VPN cannot be setup , retry.
Two Issues:
The VPN setup/configuration fails (Lets start with this one, could be related to second issue).
Remote Desktop setup is completed. However the "Remote Desktop Gateway" service cannot be started because the dependant service RPC/HTTP Load Balancing cannot start.
Troubleshooting steps taken on the VPN setup Issue:
Restarting the server (multiple times)
Rerunning the wizard (multiple times)
Checking if the correct roles has been installed by Server Essentials
Checking log files dashboard.log (The error found)
Run sfc /scannow (errors found and corrected)
Run DISM (OK)
Tried to setup VPN manually using the RRAS GUI (Error: Installation of the Routing and Remote Access service failed because Class not registered 80040154)
Further I've concluded that the 1st (VPN) issue is probably casued by malfunctioning WMI
In the dashboard.log , when running the VPN setup an error can be found on one of the setup steps:
[6684] 140723.170909.2619: RemoteAccess: PS > RemoteAccess\Install-RemoteAccess -VpnType Vpn;
[3320] 140723.170910.1772: DomainManagerObjectModel: Calling KeepAlive for instanceID=1
[3320] 140723.170910.1772: DomainManagerObjectModel: KeepAlive succeeded for instanceID=1
[6684] 140723.170918.1943: RemoteAccess: PS Exception (catch and rethrow): System.Management.Automation.MethodInvocationException: Exception calling "EndProcessing" with "0" argument(s): "Object reference not set to an instance
of an object." ---> System.NullReferenceException: Object reference not set to an instance of an object.
To troubleshoot this further, i've run the PS command "Install-RemoteAccess -VpnType Vpn" manually. This gives me the following error which Points to a WMI issue
PS C:\Windows\system32> RemoteAccess\Install-RemoteAccess -VpnType Vpn
RemoteAccess\Install-RemoteAccess : Provider load failure
At line:1 char:1
+ RemoteAccess\Install-RemoteAccess -VpnType Vpn
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (PS_RemoteAccess:root/Microsoft/...PS_RemoteAccess) [Install-RemoteAccess]
   , CimException
    + FullyQualifiedErrorId : HRESULT 0x80041013,Install-RemoteAccess
Ran WMIdiag - Found errors. The most interesting error is found below
53059 22:43:35 (2) !! WARNING: WMI provider DCOM registrations missing for the following provider(s): ..................................... 3 WARNING(S)!
53060 22:43:35 (0) ** - ROOT/CIMV2/TERMINALSERVICES, AAGProvider ({75D15B16-228C-499F-A0FC-E4899AC870CE}) (i.e. WMI Class 'Win32_TSGatewayResourceGroup')
53061 22:43:35 (0) **   Provider DLL: ''
53062 22:43:35 (0) ** - ROOT/WEBADMINISTRATION, WebAdministrationProvider ({84951D16-922E-4692-B4E9-90DD80426ECF}) (i.e. WMI Class 'SiteContainsConfigurationSection')
53063 22:43:35 (0) **   Provider DLL: ''
53064 22:43:35 (0) ** - ROOT/MICROSOFT/WINDOWS/REMOTEACCESS/SERVER, RAServerPSProvider ({BEF7FC3B-203F-4AD6-B38E-A1F519202644})
53065 22:43:35 (0) **   Provider DLL: ''
The WMIDiag provider CSV shows that the RASERVERPSPROVIDER.DLL has no DCOM (WMI Provider Binary) registration. (see example below)
WMI Namespace
WMI Class name
WMI Provider Name
WMI Provider Model
WMI provider binary
WMI provider registration MOF file(s)
ROOT/MICROSOFT/WINDOWS/REMOTEACCESS/SERVER
PS_RemoteAccessLocal
RAServerPSProvider
No DCOM registry registration
No DCOM registry registration
C:\WINDOWS\SYSTEM32\WBEM\RASERVERPSPROVIDER.MOF
So I've tried to reregister the DLLs with regsvr32 RASERVERPSPROVIDER.DLL. I've also tried to recompile the MOFs (RASERVERPSPROVIDER.MOF). I found the missing DLL and MOF using WMIDiag on Another Server Essentials 2012 R2 machine. But no sucess - the WMI
Provider binaries and model are still missing..
Example from another (healty) 2012 R2 Essentials Server
WMI Namespace
WMI Class name
WMI Provider Name
WMI Provider Model
WMI provider binary
WMI provider registration MOF file(s)
ROOT/MICROSOFT/WINDOWS/REMOTEACCESS/SERVER
PS_RemoteAccessLocal
RAServerPSProvider
In-proc
C:\WINDOWS\SYSTEM32\WBEM\RASERVERPSPROVIDER.DLL
C:\WINDOWS\SYSTEM32\WBEM\RASERVERPSPROVIDER.MOF
Is there any other way to add the WMI provider binary manually? Or do you think I'm on the wrong track?
Thank you in advance.
Regards
Josef
Support Engineer
(MCP) Microsoft Certified Professional
(MCTS) Exchange Server 2010, Configuring
(CCNA) Cisco Certified Network Associate

Hi,
Here is a good blog to troubleshoot WMI issues.
WMI: Rebuilding the WMI Repository
http://blogs.technet.com/b/askperf/archive/2009/04/13/wmi-rebuilding-the-wmi-repository.aspx
First, I want to confirm if the good system is at the same hotfix/SP.
Re-register all of the dlls and recompile the .mofs in the wbem folder and re-registering WMI Service and Provider. Then verify the consistence of the repository.
If the issue persists, we can choose to rebuild the repository.
Hope this helps.

Windows Server Essentials 2012 error code: 2147942403 The system cannot find the path specified

Running Windows Server 2012 Essentials with an external usb 3 drive as a backup device. Using a Vantec hx enclosure with a WD Red drive. Last night the Dashboard saw the drive with about half the 4TB available for backup. A.M., I get "error code:
2147942403 The system cannot find the path specified".
Going to the server desktop, I see a message indicating that the usb device malfunctioned. unplugging it, and plugging it back in, I now have it available via the dashboard.
This has happened a couple times with two different drives in Vantec hx enclosures.
A couple possibilities come to mind:
the enclosures may both be bad...
there is some problem with the system software and external usb drive.
Thoughts?
Suggestions for external enclosures?
Thanks!

Hi,
According to your description, my understanding is that you cannot backup the Windows Server Essentials 2012 and got "error code: 2147942403 The system cannot find the path specified". You found the usb device malfunctioned.
Can you backup the server when you unplugged the usb device, and plugged it back in? If you can backup the server when you replug the usb device, you need to engage the vendor to resolve the hard drive issues.
Best Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Cannot enter correct values in the SQL server express 2012 using labview

Hi everyone,
I am trying to enter the 2D array I get from DAQ into the SQL server express 2012 using Labview. When I am run the software, it connects with the table but doesn't enter the correct values. It only enters the "0" for each column of the table. I have attached the VI as well as the screenshot from the database server.
I am also writing the same 2D array data into the text file and I get the correct readins there.
Is there something I am doing wrong here.
Attachments:
test.png ‏251 KB
test3.vi ‏96 KB

If you had read the QL manuals or reference books, you would be aware SQL Server doesn't do multidimensional arrays.
I prefer BLOBs or VARCHAR(MAXCHAR) as an alternative. I enter the values in formatted string values delimiter separated.
But how to deal with multidimensional arrays. Well up to 3-5 you can use simple value for each "dimension". So the lowest dimension
would be comma delimit. The next set of values and each succeeding set for each 2nd dimension values would have the "set" of values separated
by a ":" or semicolon. For the third I use the ":" or colon to separate each 2D block of the 3rd dimension. This can all be easily reparsed
with a multidimensional parser for the application. Should be simple to build. (e.g.. Use string arrays to parse the higher dimensions
and numeric array for the lowest dimension). The VARCHAR(MAXCHAR) has an upper data bound of 2GB! If you have to save more
than 3 dimensions for most all applications, you don't understand how best to analyze the test data and may want to give it more
thought to optimize the operation as well as the design, so it doesn't get too complex. By the way I use Data Clusters built in the
data order and type as for SQL Server Data Table. This makes the design of the SQL Server interface easy as pie .

Receive a "Server is Not Available" error when trying to connect win 7 pro PC to Windows Server Essentials 2012 R2 Domain via Connector

I am trying to connect Windows 7 Pro 64 bit SP1 Computers to a Windows Server 2012 Essentials R2 domain and I receive the following error: "The server is not available. Try connecting to this computer again, or for more information, see Troubleshoot
connecting computers to the server." I have tried all of the steps in the Microsoft technet article "http://technet.microsoft.com/library/jj635102.aspx" and still am receiving this error. A little background on this specific case...
All of these computers were already attached to a different Windows Server Essentials 2012 R2 domain. They have all been taken off the existing domain and added to a workgroup. I have uninstalled the Server Essentials 2012 Connector and deleted
all log files. Has anyone else had this issue? Any help would be greatly appreciated! This is an urgent issue... Thanks in advance all!

Would you be willing to run this script on your server?
http://gallery.technet.microsoft.com/Windows-Server-Essentials-556159c3
Also on a client to test connectivity?
Robert Pearman SBS MVP
itauthority.co.uk |
Title(Required)
Facebook |
Twitter |
Linked in |
Google+

Windows Storage Server Essentials 2012 R2 + SBS 2008 Domain

I recently purchased one of the new Thecus N2000 Windows Storage Server Essentials 2012 R2 boxes and I'd like to integrate it into my SBS 2008 domain. I've successfully joined it to the domain, but whenever I try to run the "Configure Windows
Server Essentials" wizard I get an error "Configuration encountered some issues" "Please Click Retry. If the issue still exists please refer to the help link for more troubleshooting steps". Unfortunately the troubleshooting
link just takes me to these forums, and I have yet to find anything in here to get this to work.
I've tried removing the Essentials role, rebooting, re-adding the Essentials role, and re-running the "Configure Windows Server Essentials" wizard, but no good - I still continue to get the same failure.
I've read that Windows Server Essentials requires that it holds the FSMO roles and it gets angry if it doesn't hold them. SBS 2008 also requires that *it* holds the FSMO roles though, which is what prevented me from going to Windows Server Essentials.
Windows _Storage_ Server Essentials however was billed as a different product, I'm getting conflicting information from some people saying I should be able to integrate it with my SBS 2008 domain no problem, but given the fact that I'm having so much
trouble with this I'm beginning to question that.
Has anyone out there been able to add a WSSe 2012 R2 box to an SBS domain and get the two to play together nicely? What did it take?

Hi Mesan,
à
I've tried removing the Essentials role, rebooting, re-adding the Essentials role
Did you mean that Windows Server Essentials Experience role had been installed on that server? I only find that
deploy Windows Server 2012 R2 Standard/Datacenter with Windows Server Essentials Experience role
in an existing AD Environment. For more details, please refer to following article and check if can help you.
Deploying
Windows Server 2012 R2 Standard/Datacenter with Windows Server Essentials Experience role in an Existing Active Directory Environment
If any update, please feel free to let us know.
Hope this helps.
Best regards,
Justin Gu
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

How to create a SHA256 SAN Certificate for Exchange

Dear.
When using the command as described below to create a SAN Certificate for Exchange, only SHA1 certificate requests are created. How can I create the same request but for SHA256?
It seems that it's not possible to do this through the New-exchangecertificate.
Do you know the alternative command when using certreq for the following Exchange command:
New-ExchangeCertificate -PrivateKeyExportable:$true -FriendlyName 'mail.domain.com' -SubjectName 'C=NL,S="aaaa",L="bbbb",O="cccc",OU="dddd",CN=mail.domain.com' -DomainName @('mail.domain.com','exchange.wps.domain.com','webmail.domain.com','ews.domain.com','as.domain.com','oa.domain.com','oab.domain.com','ps.wps.domain.com','autodiscover.domain.com')
-RequestFile '\\10.0.6.151\c$\temp\certificate_Request.req' -GenerateRequest:$true -KeySize '2048'
Thanks for the feedback.
Regards.
Peter
Peter Van Keymeulen, IT Infrastructure Solution Architect, www.edeconsulting.be

Hi Peter,
There is no parameter in New-ExchangeCertificate to select the Algorithm type (Secure Hash Algorithm (SHA)) to generate request. Personal opinion, we can create the certificate signing request using the Certificates MMC and then creating a custom request
as follows:
1. Open MMC.exe. Click File >
Add/Remove snap in…
2. In the Available snap-ins tab, select Certificates >
Add > Computer account > Local computer >
Finish.
3. Expand Certificates (Local Computer) > Personal > Certificates.
4. In Action pane, click More Actions > All Tasks > Advanced operations > Create custom request.
5. click Next > Proceed without enrollment policy > Next > Next.
6. In Certificate Information page, click Details > Properties.
7. Then you can fill in the needed information for your request.
8. In Private Key tab, expand Select Hash Algorithm, set the Hash Algorithm to
sha256.
9. Click OK > Next. Fill in File Name and select the request location.
10. Finish it and send this request to the certificate authority.
Regards,
Winnie Liang
TechNet Community Support

How to use Nokia mail for exchange

How to use Nokia mail for exchange for N82 so that it can push mails for gmail,yahoo.

It appears that what you are looking to do is from another product at Nokia called Nokia Messaging. Go to mail.nokia.com and setup a messaging account and add the gmail and yahoo accounts there. Then SMS send the configuration program to your device. Install it. it will add all the accounts to your device on install and will send messages to your device. So at this point you will have Mail for Exchange for you corporate mail and Nokia Messaging for you personal mail ( gmail and yahoo).

OS X Server fills out wrong PayloadType for Exchange Web Services

Hi,
I've noticed a problem with OS X Server, v 3.0.2, when you configure it to setup a user with a Mac OS X Exchange Web Services (EWS) account.
There is a drop down to choose between iOS (for Exchange Active Sync) or OS X (for Exchange Web Services).
If you select EWS and fill out the fields, the generated .mobileconfig file has
PayloadType com.apple.eas.account
followed by your EWS settings.
When you install it on the Mac it also reports it as an iOS setting and does not add the account.
If you manually edit the mobileconfig file, changing PayloadType to
com.apple.ews.account
before trying to load it onto the mac, it accepts the EWS account and you can then see it listed in System Preferences->Internet accounts.
Cheers,
faz_uk.

Hi,
I've noticed a problem with OS X Server, v 3.0.2, when you configure it to setup a user with a Mac OS X Exchange Web Services (EWS) account.
There is a drop down to choose between iOS (for Exchange Active Sync) or OS X (for Exchange Web Services).
If you select EWS and fill out the fields, the generated .mobileconfig file has
PayloadType com.apple.eas.account
followed by your EWS settings.
When you install it on the Mac it also reports it as an iOS setting and does not add the account.
If you manually edit the mobileconfig file, changing PayloadType to
com.apple.ews.account
before trying to load it onto the mac, it accepts the EWS account and you can then see it listed in System Preferences->Internet accounts.
Cheers,
faz_uk.

Wildcard certificate for Exchange 2013

Hello!
I have a testing network with Exchange 2013SP1 and Windows Server 2012R2 domain controller with CA installed.
For testing purposes I issued a wildcard certificate for my Exch2013 from my local CA using Web server template and installed it on the Exchange server.
Now when I open, for example, ecp or owa page I'm getting the error stating my certificate is wrong:
Q1) Is Windows CA capable of issuing a wildcard certificates?
Q2) If Q1=yes then what can be the cause of the problem?
Thank you in advance,
Michael

Hi Michael,
Please click Certificate error in IE to view the details about the error. If the error is related to untrusted certificate, please open Internet Explorer, click Settings > Internet Option > Content option > Certificate. In the
Certificates dialog box, click the Trusted Root Certification Authorities
tab and check if your certificate is in the list.
If the certificate is not in the list, we can install the certificate in Trusted root certificate store by the following KB:
http://support2.microsoft.com/kb/2006728
If the error certificate is related to mismatch issue, please confirm if this certificate is assigned with IIS service. If not, please enable it with IIS service and restart IIS service to have a try. To double check about the Exchange certificate, we can
run the following command to check it:
Get-ExchangeCertificate | FL
Regards,
Winnie Liang
TechNet Community Support

Best practices for buying a digital certificate for Exchange 2013

Good dayfriends,
Could you indicateme which are the bestpractices when buying
a public digital certificatefor use onExchangeServer 2013.
I'd be interested in knowing your opinion about
using wildcardor SAN certificates.
Likewise what are the best recommendations
to include names and why they should or
should not include the internal FQDN
of my servers.
Currently I have an infrastructure that has two
MailBox servers,two CAS servers and an EDGE
2010 server, but I'm planning update it to Exchange 2013.
I searched what are the best
practices according to Microsoft but
have found little information.
I would appreciate
if you can post links like
Microsoft KBs and other technical documents that
discuss the above mentioned.
Thanking your
invaluable support.
Greetings.

Hi,
Personal suggestion, we can use two namespaces for your Exchange 2013:
Autodiscover.domain.com (Used for autodiscover service)
Mail.domain.com (used for all Exchange services external and internal URLs)
Please pointed mail.domain.com and autodiscover.domain.com to your internet facing CAS 2013.
For more information about Digital Certificates and SSL in Exchange 2013, please refer to the
Digital Certificates Best Practices part in the following technet article:
http://technet.microsoft.com/en-us/library/dd351044%28v=exchg.141%29.aspx?lc=1033
Additionally, here are some other scenarios about certificate planning in Exchange 2013:
http://blogs.technet.com/b/exchange/archive/2014/03/19/certificate-planning-in-exchange-2013.aspx
Regards,
Winnie Liang
TechNet Community Support

Preparing new Certificate for Exchange - how to cover the .local domain names

I need to plan out our new certificate for our CAS servers. Exchange 2010 SP3. Our current SAN certificate has several names including our Exchange FQDN's which are exserver.domain.local. I know our CA will not let me generate SAN's with a .local anymore
so how do I cover the Exchange internal FQDN's in the certificate?
I did a get-exchangecertificate and the only certificates I have are the public CA with all the SAN's and Services are IP.WS. The other two Exchange certificates are self signed but only for SMTP "S".
You can only have one certificate for web services "W" so how do you get around the Exchange FQDN? Our internal autodiscover, availability and OOF etc....that Outlook uses all use the Exchange internal FQDN of servername.domain.local.
Even if I generate another Exchange certificate for the server FQDN and submit it to our internal CA, I cannot enable web services on this certificate because my public certificate is already enabled for web services.
Need some help here. I am really stumped on this one.

Hi Shadowtuck,
It is suggested to post in the Exchange forum:
https://social.technet.microsoft.com/Forums/en-US/home?category=exchangeserver
In addition, hope the link below could be helpful for you:
Global changes in legislation regarding SAN SSL Certificates
http://www.networking4all.com/en/ssl+certificates/faq/change+san+issue/
Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Server essentials 2012 uses wrong certificate for Exchange OWA

Similar Messages

Maybe you are looking for