Upgrade SSL Certificate for Exchange Server

Hi Folks,
I need to upgrade the SSL certificate on my Exchange Server, so he can negotiate encryption and authorization to an upstream SMTP Smart Host. This means that the certificate I need is not necessarily a server certificate, because in this scenario Exchange
Server is acting as a client to the upstream SMTP Smart Host. I have openssl at my disposal, so making the certificate in not a problem but installing it in the correct location and testing that I've done what I think I've done is.
Thanks for the help,
Chris.
Thanks for the help,
Chris.

Hi,
Please just make sure the primary certificate in your Exchange server with
SMTP service is valid, trusted by your SMTP smart host.
Thanks,
Winnie Liang
TechNet Community Support

Similar Messages

Is it possible to use single ssl certificate for multiple server farm with different FQDN?

Hi
We generated the CSR request for versign secure site pro certificate
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
SSL Certificate for cn=abc.com considering abc.com as our major domain. now we have servers in this domain like www.abc.com, a.abc.com , b.abc.com etc. we installed the verisign certificate and configured ACE-20 accordingly for ssl-proxy and we will use same certificate gerated for abc.com for all servers like www.abc.com , a.abc.com , b.abc.com etc. Now when we are trying to access https//www..abc.com or https://a.abc.com through mozilla , we are able to access the service but we are getting this message in certfucate status " you are connected to abc.com which is run by unknown "
And the same message when trying to access https://www.abc.com from Google Chrome.
"This is probably not the site you are looking for! You attempted to reach www.abc.com, but instead you actually reached a server identifying itself as abc.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of adgate.kfu.edu.sa. You should not proceed"
so i know as this certficate is for cn=abc.com that is why we are getting such errors/status in ssl certficate.
Now my question is
1. Is is possible to remove above errors doing some ssl configuration on ACE?
2. OR we have to go for VerisgnWildcard Secure Site Pro Certificate for CSR generated uisng cn =abc.com to be installed on ACE and will be used for all servers like www.abc.com , a.abc.com etc..
Thanks
Waliullah

If you want to use the same VIP and port number for multiple FQDNs, then you will need to get a wildcard certificate. Currently, if you enter www.abc.com in your browser, that is what the browser expects to see in the certificate. And right now it won't beause your certificate is for abc.com. You need a wildcard cert that will be for something like *.abc.com.
Hope this helps,
Sean

Use Homepage SSL certificate as exchange server certificate?

the certicate needs to match the fully qualified domain name that you connect against.
so if the web site uses www.domain.de and the echange server's OWA/Activesync is owa.domain.de it wont match and you'll get errors. However if the SSL cert is wildcard to *.domain.de you'll be OK.

Hi there,
im a little certificate dau
i have a certificate for our homepage which certifies on "Domain123.de".
Is it possible to use this certificate for our mail server? (exchange 2007)
The mail domain is "[email protected]"
Our AD Domain is "Domain456.local"
I hope you can help me here.
Heres some bacon to attract the pros
This topic first appeared in the Spiceworks Community

Use ssl certificate for Exchange Account

Hello everyone!
I have some problem with Exchange instance and iphones.
I have Front server with client authentication via ssl certificates. How i can use this certificate on iphone to connect iphone to exchanges account?
After few hours of googling i find only one solution here - http://www.msexchange.org/articles-tutorials/exchange-server-2010/mobility-clien t-access/configuring-certificate-based-authentication-exchange-2010-activesync-p art2.html
In few words - it can be done with iPhone Configuration Utility
Does this ONLY solution or i can import ssl cert directly to iphone?
Thanks a lot for any help

Hi bb9193, this will not be no short-term solution, but you might consider using a MDM-solution. With MDM it is possible to deinstall and reinstall the Exchange profile over the air, so your users will not need to do more than just reenter their Exchange password.
Best regards,
Detlev

New SSL certificate for Exchange, iPhones won't accept without delete/recreate of account on phone.

Our Network Solutions security certificate was about to expire so we renewed it, however once it was installed on the Exchange 2007 server the phones would no longer connect. How do you get the iPhones that are already connected to your Exchange server to recognize the new certificate?

Hi bb9193, this will not be no short-term solution, but you might consider using a MDM-solution. With MDM it is possible to deinstall and reinstall the Exchange profile over the air, so your users will not need to do more than just reenter their Exchange password.
Best regards,
Detlev

Using an SSL certificate for Exchange 2013

Hi,
I am not sure if this is the correct forum to post this question in.
Basically we are migrating from Exchange 2007 to Exchange 2013. Our 2013 machines have both roles installed and do everything. They are configured in a DAG. We have no hardware load balancing/reverse proxy or etc. inside or outside.
We use an alias of mail.domain.com to connect to OWA/ActiveSync and etc from the Internet.. this alias would point to mail1.domain.com which is the IP of the first Exchange 2013 server.
If that server were to break, we would point the alias of mail.domain.com to mail2.domain.com which is the IP of the second Exchange 2013 server. Clients would not need any changes before they started connecting to the remaining mail server (eventually)
and email would continue.
I know this is not an ideal setup, but for now it is what we have and would keep us running in the event of server failure.
My question is, when I request a certificate, do I need two of them with mail1.domain.com and mail2.domain.com as their primary and SAN of mail.domain.com OR do I request one certificate with mail.domain.com as the primary host and SAN of mail1.domain.com
and mail2.domain.com (and install the one certificate on both servers).
I want to include mail1.domain.com and mail2.domain.com as this can be helpful for testing and/or during migration.
I hope that makes some sense and appreciate any help people can offer.
Thanks!

You do not need server names in the certificate if you are using mail.domain.com only in all of the URL settings. You will want autodiscover.domain.com, however.
Consider configuring a different internal and external name for Outlook Anywhere so that Outlook knows whether it is connecting from the Internet or internally. For internal Outlook Anywhere, use a name that you don't publish to the Internet.
For example, use mail.domain.com for everything except internal Outlook Anywhere, use mailinternal.domain.com. Put mail.domain.com, mailinternal.domain.com and autodiscover.domain.com in the certificate.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Yosemite Mail Upgrade: The Certificate for this server is invalid.

After the OS upgrade to Yosemite I can receive emails, but I am unable to send them. Has anyone fixed this problem?

try Repairing Disk Permissions in Disk Utility, it works for me

Preparing new Certificate for Exchange - how to cover the .local domain names

I need to plan out our new certificate for our CAS servers. Exchange 2010 SP3. Our current SAN certificate has several names including our Exchange FQDN's which are exserver.domain.local. I know our CA will not let me generate SAN's with a .local anymore
so how do I cover the Exchange internal FQDN's in the certificate?
I did a get-exchangecertificate and the only certificates I have are the public CA with all the SAN's and Services are IP.WS. The other two Exchange certificates are self signed but only for SMTP "S".
You can only have one certificate for web services "W" so how do you get around the Exchange FQDN? Our internal autodiscover, availability and OOF etc....that Outlook uses all use the Exchange internal FQDN of servername.domain.local.
Even if I generate another Exchange certificate for the server FQDN and submit it to our internal CA, I cannot enable web services on this certificate because my public certificate is already enabled for web services.
Need some help here. I am really stumped on this one.

Hi Shadowtuck,
It is suggested to post in the Exchange forum:
https://social.technet.microsoft.com/Forums/en-US/home?category=exchangeserver
In addition, hope the link below could be helpful for you:
Global changes in legislation regarding SAN SSL Certificates
http://www.networking4all.com/en/ssl+certificates/faq/change+san+issue/
Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

SHA-2 SSL certificates supported on Server v10.5?

Am upgrading Mac OS Server 10.4.11 on a PowerPC Mac Mini (1.42GHz) to Server 10.5 and currently have SHA-1 SSL certificate from GoDaddy.
They want everyone to upgrade to a SHA-2 (SHA256) SSL certificate for Google's Chrome browser which will soon start showing SSL errors for SHA-1 certificates.
Is Mac OS Server 10.5 capable of serving up a SHA-2 SSL certificate? (I originally renewed last Feb. to a SHA-2 certificate, but many browsers didn't recognize it, so I re-keyed to a SHA-1 certificate that is good to 12/31/15.
Mac mini, Mac OS X Server (10.4.11, upgrading to 10.5.x), Power PC 1.42GHz

Hi, I do not know, but I doubt it.
Here's the 10.4 Server forum if you want to ask over there...
Mac OS X Server v10.4 and earlier

The certificate for this server is invalid

Hi can anyone help? I get a message "cannot connect to iTunes Store" when selecting App Store on my iPod. Also if I try iTunes icon, I get "the certificate for this server is invalid. You might be connecting to a server that is pretending to be "itunes.apple.com" which could put your confidential information at risk"
The steps I have taken so far, - connected to PC and updated software to iOS 6.1.3 (worked fine on PC)
Checked WiFi connection (fine)
Checked other apple products are working fine (yes)
Checked i am logged into apple id (yes)
Is there anything else I'm missing ??
Thanks aliian

Thanks to those contributing this fix -- had this issue on my son's iPad mini and was going crazy trying to figure it out!!
To answer the question of why this causes an issue: this is part of the standard security features of the internet - when you connect securely to a server (as the i-devices do when accessing itunes), it has an SSL Certificate which has an expiry date on it -- the device checks the certificate to try and make sure you aren't getting duped by an out of date certificate, and if your date is set too far in the future (my son's was in 2019!) then it looks like the expiry date is in the past and it won't let you connect..
Cheers!

Forefront for Exchange Server

Before upgrading to Exchange Server 2013 we were using Exchange Server 2010 with Forefront Protection 2010 for Exchange Server to protect our system from virus/ malware, it works effectively. After upgrading to Exchange Server 2013, the forefront Protection
2010 does not support Exchange 2013. I know that MS added anti malware function to Exchange Server 2013 but it does not work effectively.
So the question is: does MS has any other program instead of Forefront Protection 2010 which support Exchange Server 2013.

Hi,
You could have a look at Exchange Online Protection that hosted email filtering service.
http://technet.microsoft.com/en-us/library/jj723137(v=exchg.150).aspx
Best Regads,
Joyce

Renewal of Forefront Protection 2010 for Exchange Server until EOL

Hello,
We have a Open Value subscription for Forefront Protection for Exchange Server 2010 (FPE) running with an Exchange 2007 server and an Edge Server. We attempted to renew the subscription to FPE and were automatically upgraded to FOPE and now EOP.
Since FPE is not End of Life yet, might it be possible to renew FPE on premises until such time as the product goes End of Life?
thank you,
Dan

Hello,
FPE on premises was available only as a subscription license in OV, OVS. for subscription products thre is not possibility to renew th elicensing if is removed from product list.
you can purchase FOPE(in OVS) or EOP as online subscription. you can use also EOP for on premises Exchnage Server.
on Microsoft document we have th efollowing info:
The following are the primary ways you can use EOP for messaging protection:
In a standalone scenario   EOP provides cloud-based email protection for your "on-premises Microsoft Exchange Server 2013 environment, legacy Exchange Server versions,
or for any other on-premises SMTP email solution."
As a part of Microsoft Exchange Online   By default, EOP protects Microsoft Exchange Online cloud-hosted mailboxes.
In a hybrid deployment   EOP can be configured to protect your messaging environment and control mail routing when you have a mix of on-premises and cloud mailboxes.
note: EOP replaces Microsoft Forefront Online Protection for Exchange (FOPE). All FOPE customers will be transitioned to EOP, as described in the
Forefront Online Protection for Exchange (FOPE) transition center. EOP delivers the protection and control provided by FOPE, and also includes additional features.
What's new in Exchange Online Protection describes some of these features.
thanks
diramoh

The SSL certificate of the server is expired

Today, I accessed Beehive Online via Oracle Beehive Extentions for Explorer.
I cannot use Beehive Online with error message "The SSL certificate of the server is expired".
How should I do?

We're looking into it, meanwhile you can use a Webdav connection.
Thanks,
Jereen

Installing Update Rollup 7 for Exchange Server 2010 SP3

Hi,
I have 4 Exchange servers. Two CAS and two DAG. I am currently on Rollup 2 for Exchange Server 3010 SP 3. Can I install Update Rollup 7 for Exchange Server 2010 SP3 or do I need to install a previous one first?
Thannks!
Wave~Chaser

Hi,
When I try to install Exchange 2010 SP3 roll up 7, am getting the below error:
The upgrade cannot be installed by the Windows Installer service because the program to be upgraded may
be missing, or the upgrade may update a different version of the program. Verify that the program to be upgraded exists on your computer and that you have the correct upgrade.
and please find below event log:
Product: Microsoft Exchange Server - Update '{A93DA06F-A5B8-4DF8-8B3F-B285E014C659}' could not be installed. Error code 1642. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions
on turning on logging support.
Can you please help me with this error.
Thanks

How we can get SSL certificate for any site?

i want to know how can get SSL certificate for any website and what is the main benefit for particular website with the help of this certificate.

Hi,
Would you please let me know edition information of the SBS server? Was it SBS 2008 or SBS 2011?
Based on your description, I’m a little confused with your question. Did you mean that want to know why need
SSL certificate for website?
Certificate Services and SSL protect sensitive information by encrypting the data sent between client browsers
and your server.
An SSL Certificate is used for two reasons (1) to validate the remote server to the client before the client sends any data to that server (2) to encrypt the data between the client and server over an un-secure network (ie. the Internet). You can use
a self-issued certificate or a third-party trusted certificate. For more details, please refer to following articles and check if can help you.
Managing Certificates
SSL and Certificates
Understanding Self-Issued
Certificates in SBS 2003 & SBS 2008
Installing a GoDaddy Standard
SSL Certificate on SBS 2008
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft
does not guarantee the accuracy of this information.
If anything I misunderstand or any update, please don’t hesitate to let me know.
Hope this helps.
Best regards,
Justin Gu

Upgrade SSL Certificate for Exchange Server

Similar Messages

Maybe you are looking for