Home / server / Questions / 101003
Accepted
WedTM
Asked: 2010-01-09 14:07:53 +0800 CST

Exchange Autodiscover, SSL Cert. Issue

  • 772

I've ran through the tests at http://testexchangeconnectivity.com/ and The ActiveSync test is passing, but with warnings.

This is the warning I get:

Only able to build certificate chain when using the Root Certificate Update functionality from Windows Update. Your server may not be properly configured to send down the required intermediate certificates to complete the chain. Consult the certificate installation instructions or FAQ's from your Certificate Authority for more information.

I purchased the SSL cert from godaddy, but I'm not quite sure where to go from here.

exchange ssl autodiscovery

3 Answers

  1. Best Answer

    Use http://www.sslshopper.com/ssl-checker.html to see what Intermediate certificates are being given out by the server. It should be giving out everything except for the last root certificate. You can see what the chain should be by viewing the certificate in a web browser. If it is missing any Intermediates, just find the Intermediates bundle file that GoDaddy sent you and install it on the server.

    • 1

  2. The certificate you purchased using using a root trust that has been introduced into the world since 2002. This is very normal. It just means an ancient computer running Windows 98 and IE3 will get a certificate warning, that's all.

    The real warning should tell you: Test this out on Android,iPhone,WindowsMobile.. because there is a slightly greater chance some of these handhelds won't like your certificate.

    • 1

  3. Did you get an Exchange UC certificate for multiple subdomains? For example, you need autodiscover.yourdomain.com included with your domain names.

    For example: http://www.digicert.com/unified-communications-ssl-tls.htm

    Or http://www.instantssl.com/ssl-certificate-products/ssl-certificate-ucc.html

    (I use the one from comodo).

    For simplicity's sake, you really should use a UC Certificate from an authority rather than trying to self-sign or use lots of individual certificates.

    • 0