Certificate issues

[MasterRacker]

We are just beginning our upgrade to Exchange 2010. We've found there are issues with Outlook 2010 unless we install the proper certificates into Exchange. Our internal domain is ".int" and we've found we can't get a UCC certificate for that since .int is a valid TLD.

Renaming the domain will probably suck and it looks like we also have to scrap our test Exchange 2010 server since MS says rename won't work on that at all.

My question is: if we can't get a UCC cert now for .int, what happens in the future for certs for internal domains after ICANN allows ".anything?"

Just looking for insight to help us decide which direction to go today.

Jeff
[small][purple]It's never too early to begin preparing for [/purple]International Talk Like a Pirate Day
"The software I buy sucks, The software I write sucks. It's time to give up and have a beer..." - Me[/small]

 

[MasterRacker]

Or a second question would be since we can't get a public certificate for our internal domain, what are our options?

Jeff
[small][purple]It's never too early to begin preparing for [/purple]International Talk Like a Pirate Day
"The software I buy sucks, The software I write sucks. It's time to give up and have a beer..." - Me[/small]

 

[58sniper]

Internal domain names don't need to be in your certs. The most often used method is to use what's called split brain DNS. So, internally, you have a forward lookup zone for your EXTERNAL domain name. That way, when you want to go to say, mail.domain.com for your OWA page, it resolves to an internal IP address when inside the environment, and an outside IP when outside the environment.

I never include internal names in my certs.

Stop by the new Tek-Tips group at LinkedIn. Come say hi, look for a job, have some fun.

http://www.linkedin.com/groups/Networking-TekTipscom-forums-members-3952395

Pat Richard MVP

http://www.exchangeblogs.com/

 

[MasterRacker]

We already use split brain DNS - OWA is fine - it's Outlook 2010 with Exchange 2010 that has the problem.

As I understand it, with Exchange 2007 and 2010, Outlook itself uses the internal domain and needs a cert. Outlook 2010 at least.

Jeff
[small][purple]It's never too early to begin preparing for [/purple]International Talk Like a Pirate Day
"The software I buy sucks, The software I write sucks. It's time to give up and have a beer..." - Me[/small]

 

[58sniper]

It uses what's configured for the internal URL. That can be the split DNS name. And that name should already be in the certificate CN or SANs.

Stop by the new Tek-Tips group at LinkedIn. Come say hi, look for a job, have some fun.

http://www.linkedin.com/groups/Networking-TekTipscom-forums-members-3952395

Pat Richard MVP

http://www.exchangeblogs.com/