Getting my first SSL Cert for OWA and ActiveSync.

[Pablonhd]

When using New-ExchangeCertificate do I need to generate the request to inclued all the names for my server or only the public names?

For example from the web my server is mail.sub.domain.com but NAT's internally to my server is exchange.sub.domain.com. I know this is odd but I inheirited this configuration.

To date we have had no servces accessiable from the web. MX servers on the main domain handle all inbound email and hand it off you our sub domain's exchange server.

We are looking at allowing OWA and ActiveSync and to do so we want a SSL cert that is not self singed.

My question is would the ssl cert request need to cover the external name and the internal name for my server? Or do i only use the external names to cover the external access and continue to use the self signed cert for interal services accessing the internal name?

If this is a stupid question please go easy on me as this is new territory for me.

 

[58sniper]

So, if your OWA address is going to be

https://mail.sub.domain.com/owa,

then that name (mail.sub.domain.com) needs to appear in your cert.

You also need to account for autodiscover to support EAS mobile devices. So figure out what your autodiscover name is going to be. Likely something like autodiscover.sub.domain.com, and include that.

If you have users using OWA internally, and you're NOT using split brain DNS, then you need to include that URI - something like mail.sub.domain.local. I always use split brain DNS, so I never have internal names in externally facing certificates.

If you're using a single Exchange server (Hub and CAS roles combined), then you probably want to include your MX records if they are different than your OWA address. That way, the server can support TLS to the outside world for SMTP.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.exchangeblogs.com/