0

SBS 2008 server the third party SSL certificate has just expired!!

trying to renew with a two year, SAN/Multi-Domain SSL

going through the SBS Console Adding a new cert and get the CSR copy/paste into the website to generate the cert it shows me my external domains AND my .local domain...

  • ~ExtDomain~.co.uk
  • remote.~ExtDomain~.co.uk
  • SBS-SRV.~IntDomain~.local

we need to remove 'SBS-SRV.~IntDomain~.local' from the CSR as only external FQDN are allowed in the new SHA-2 certificates.

Exchange 2007 Shell

Get-ClientAccessServer | select name,*internal* | fl 
Get-OABVirtualDirectory | select server,name,*url* | fl
Get-WebServicesVirtualDirectory | select name,*url* | fl
Get-UMVirtualDirectory | select name,*url* | fl
Get-ActivesyncVirtualDirectory | select name,*url* | fl
Get-OwaVirtualDirectory | select name,*url* | fl
Get-OutlookAnywhere | fl

all the above (and variants with out filters) are showing InternalURL and ExternalURL as the correct ExtDomain names

i.e. 

[PS] C:\>Get-ClientAccessServer | Select Name, *Internal* | fl
Name    : xxxxxx-srv
AutoDiscoverServiceInternalUri : https://remote.xxxxxx.co.uk/Autodiscover/Autodiscover.xml

[PS] C:\>Get-OABVirtualDirectory | select server,name,*url* | fl
Server      : xxxxxx-srv
Name        : OAB (SBS Web Applications)
InternalUrl : https://remote.xxxxxx.co.uk/OAB
ExternalUrl : https://remote.xxxxxx.co.uk/OAB

[PS] C:\>Get-WebServicesVirtualDirectory | Select name, *url* | fl
Name                 : EWS (SBS Web Applications)
InternalNLBBypassUrl : https://xxxxxx-srv.xxxxxx.local/EWS/Exchange.asmx
InternalUrl          : https://remote.xxxxxx.co.uk/EWS/Exchange.asmx
ExternalUrl          : https://remote.xxxxxx.co.uk/EWS/Exchange.asmx

I have read lots of posts but all was OK and I havnt needed to change anything

ref - http://support.microsoft.com/en-us/kb/940726

Any ideas?

Many Thanks.

Sparki
  • 143

1 Answers1

1

Fire up your own internal CA. Issue a cert with whatever names you need/want on it. Use Active Directory to deploy it to your domain-joined clients. Users who are not members of your Active Directory domain will get certificate errors that they will have to ignore until you've migrated to an adequately named domain and can once again replace with a globally trusted certificate.

Ryan Ries
  • 56,311