Do I need an enterprise CA 2

[ouzojd]

Hi, just about to upgrade DCs from 2000 boxes to 2003R2. Only question is one of the DCs has an enterprise CA on it which from what I can tell isnt used (used to be for OWA but now use 3rd party cert), there is 2 current certificates issued, one to itself (the DC that runs the CA) and one isseud to the other DC.

So do DCs actually require a CA for replication or can I just ignore its existence and after the server is demoted from been a DC turn it off and forget about it?

Thanks

 

[gmail2]

I'm no expert on CA's, but no, DC's don't need certificates for replication, so it sounds like the certs were there purely for exchange. But maybe somebody with more exchange experience than me can help answer you better

Irish Poetry - Karen O'Connor
Irish Poetry and Short Stories - Doghouse Books
Garten und Landschaftsbau

 

[58sniper]

If you're using a commercial cert for OWA/RPC/EAS, then Exchange doesn't need an internal CA for anything.

I'd caution you against killing off the CA unless you do your due diligence to find out if it's being used for anything else. Any other websites configured in IIS that might use a cert?

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP

 

[ouzojd]

We do have one other ssl site but that uses a verisign certificate as well. Are you able to just clarify what RPC and EAS are abbreviations for so I can check.

My exchange server name doesnt have any current certs issued to it by the CA I have here. Only the 2 DCs - the one the CA is on looks like it had exchange 5.5 on it at some point and IIS so maybe thats part of the reason.

I just wasnt sure why the other DC would be getting a cert?

 

[58sniper]

RPC = RPC over HTTPS - using Outlook outside of your firewall
EAS = Exchange Active Sync on Windows Mobile phones

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP

 

[ouzojd]

OK thanks, yes we do use Activesync with our phones but verisign gave us a little cab file to run on the phones which allows them to connect so I'm 99% sure that must all be covered by the same verisign cert, I installed the cert at the default web site level in IIS on the exchange box.

If I uninstall the CA do you think that will remove any references to it in AD as well?

Thanks