bfloriang's questions

I'm curious if it is possible to restrict which subject alternative names are allowed for certificate signing requests towards ADCS. I would like to prevent issuing wildcard certificates for example. I did have a look at ADCS certificate templates but I don't see any settings that would influence this behavior.

I understand that one way to prevent this is CA manager approval and reviewing requests but in an environment where no such approval happens it would be good to have support for "blocklists" or rules / policies that the CSR has to adhere to and if a request to sign a certificate for *.example.com comes in and simply discards the request.

I've setup a wildcard CNAME entry as an alias for one of my servers that looks like this:

*.custom.example.my.home

When I try to resolve matching entries without specifying the domain (e.g. asdf.custom) I get different behaviours from OS X, Linux and Windows. So just to clarify for all these OSs specifying the fully qualified domain name (e.g. asdf.custom.example.my.home) will lead to a successful lookup.

For Linux and OS X the specified DNS search suffixes are tried as expected, so the entries are resolvable, ping works, the webserver running on the server can be reached whereas in Windows none of these simple networking operations work.

PS C:\Users\> ping asdf.custom
Ping request could not find host asdf.custom Please check the name and try again.
PS C:\Users\> .\nslookup.exe asdf.custom
Server:         192.168.X.X
Address:        192.168.X.X#53

** server can't find asdf.custom: NXDOMAIN

What I suspect is that the Windows DNS implementation assumes that finding the dot it is dealing with the absolute name already, while it should actually try to go through the configured DNS suffixes. I'm wondering if there is a setting to instruct it to do so.

I'm observing this behaviour for Windows 7 / Server 2008, but haven't tried anything else.

I was wondering if anyone can offer some guidance on the nature of the load that is generated on a Exchange 2013 server.

The background of my question is that I'm currently considering options concerning the CPU of my servers. I have servers available to me with lower frequency but many cores, which are usually used for parallel processing workloads (Intel Xeon 1.7GHz, 20 core, 40 threads due to hyperthreading). Should I look for a more high spec CPU or will this do?

The server will host about 150 mailboxes in a corporate environment.