Home / server / Questions / 397384
In Process
Neil
Asked: 2012-06-11 11:36:45 +0800 CST

Make Exchange 2007 use the correct SSL certificate

  • 772

I have an SBS 2008 server contososerver.contosodomain.local which is externally accessible with the domain remote.contoso.com and an SSL certificate for the external domain which we installed using the SBS 2008 wizard. This works great for OWA because IIS serves the remote.contoso.com certificate. I also want to turn on external POP3/IMAP4/SMTP however when I try, I get served the internal certificate that SBS generated automatically (using its internal CA) which has the alternate names remote.contoso.com, contososerver.contosodomain.local and contososerver. I tried removing this certificate from Exchange but it won't let me because it needs it for its internal receive connector. So how do I tell Exchange 2007 to use the real certificate for external POP3/IMAP4/SMTP?

exchange-2007 ssl-certificate

1 Answers

  1. The procedure seems to be easier in SBS 2010 because Exchange 2010 has certificate management in its GUI. The steps are as follows:

    1. Open Exchange Management Console.
    2. Expand and select Server Configuration.
    3. You should see several certificates, typically including:
      1. Your trusted certificate for the external domain associated with the IMAP, POP, IIS and SMTP services.
      2. Your SBS certificate for both internal and external domains associated with the SMTP service.
      3. An internal certificate for the internal domain associated with the SMTP service.
      4. An internal certificate for the placeholder Sites site that existed before you ran the Internet address wizard.
    4. You can't delete your SBS certificate because one of its alternate names is for your internal domain and it's still the selected certificate for that domain.
    5. Select the internal certificate for the internal domain name and assign the SMTP service to the certificate. When prompted, overwrite the existing default SMTP certificate. You will be warned that the SBS certificate still takes precedence because it is signed by a CA.
    6. Now you can remove the SBS certificate.
    • 0