Home / server / Questions / 425944
Accepted
Frederik
Asked: 2012-09-11 04:27:38 +0800 CST

Exchange 2010 certificate errors

  • 772

I have a problem with my newly setup Exchange environment for our hosted customers.

First off, when configuring the outlook client, it gives a certificate warning although the certificate has been bought and setup.

I am using a setup like this:
autodiscover.CUSTOMERDOMAIN.TLD CNAME autodiscover.exchange.COMPANYDOMAIN.TLD
(Companydomain is our company that hosts the exchange servers, customerdomain being the customers domain)

Shouldn't that work? I know that Microsoft does something like that for Office365, but I really don't think they buy a certificate for every customer..

So I guess some redirection should be setup somehow - any guidance?

Next thing: When we accept that error, and move on to actually starting Outlook, it states that the certificate is not valid for the RPC proxy server exchange.COMPANYDOMAIN.TLD - this domain is not right, as that domain is not included in the certificate. I would instead like this domain to be mail.exchange.COMPANYDOMAIN.TLD

I tried to run this script setting both internal and external URL's to be the same, with no luck.

Any guidance on this one?

I am running Exchange 2010 SP2, with CAS, HT and MBX split up on 3 different servers.

Update: I have now fixed the issue with the RPC proxy server.

The commands used was: To see what it is currently set to: 

get-outlookanywhere |fl externalhostname

To set it to something else:

set-outlookanywhere -identity "exchcas01\rpc (Default Web Site)" -externalhostname "NEWHOSTNAME"

However, I am still having issues with the first problem.

Update 2:

I have gotten further with the first problem. I have setup a small nginx server, that basically only redirects all requests sent to the server to https://autodiscover.exchange.COMPANYDOMAIN.TLD/Autodiscover/autodiscover.xml and this works.. Not so well.. as Outlook tries to create a unsecure connection. How can I redirect from the requested URL, to the SSL URL, without Outlook making a mess?

nginx

2 Answers

  1. A certificate will only be valid for the exact host name it was created for. That's the "CN" (Common Name) part of the "Subject" field in the certificate.

    The typical way to deal with what you're doing is to buy a certificate with another field called "Subject Alternate Names" where you can list other hosts name that should be considered valid by the client. These certificates typically are a bit more expensive (although not always).

    • 0
  2. Best Answer

    This Technet article was exactly what I wanted - to setup some simple redirection that Oulook understands.

    • 0