Wildcard Cert - invalid for exchange server usage

[snootalope]

We got a wildcart cert from godaddy that we currently use on our exchange 2003 box.

I'm setting up our to be exchange 2010 box and I import our wildcard cert under Server Config\exchange certificates - imports just fine. However, once it's imported, the "Default Web Site" shows up and says "The certificate is invalid for Exchange Server usage."

There's also the "Microsoft Exchange" Cert there that's self signed and it checks out just fine and has all the services assigned to it.. Anyway, I want to use this wildcard godaddy cert for TLS. Anyone else seeing this message when they import a third party cert or wildcard?

 

[58sniper]

Did you install the intermediate cert from GoDaddy?

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[snootalope]

I installed the Go Daddy PKCS7 Certificate Intermediates Bundle for IIS..

 

[58sniper]

Do a

Get-ExchangeCertificate | ? {$_.RootCAType -eq 'ThirdParty'} | fl issuer,status

See if it's valid or pending.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[58sniper]

Whoops -

Let's use

Get-ExchangeCertificate | ? {$_.RootCAType -eq 'ThirdParty'} | fl issuer,status,services

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[snootalope]

hmm.. that doesn't return anything.

 

[58sniper]

Do you get anything by using just Get-ExchangeCertificate?

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[snootalope]

yeah.. that shows my wildcard cert and the self-signed cert.

 

[58sniper]

What does it say for Status and Services for the wildcard?

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[snootalope]

Doesn't show any status, just thumbprint/services/subject.

Services are all assigned to the self-signed cert at the moment so the services for the wildcard are empty.

 

[58sniper]

Ah - you need to enable the wildcard cert for the services you want to use it for. Likely SMTP and IIS.

http://technet.microsoft.com/en-us/library/aa997231(EXCHG.80).aspx

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[snootalope]

That's what I did before removing all the service because of the error, I tried it again though and got the same message I got using the GUI:

[PS] C:\>Enable-ExchangeCertificate FFD02E87BD29D6C3ED9C7497CF6304F7BFB4364F -services "POP,IIS,SMTP"
WARNING: This certificate will not be used for external TLS connections with an FQDN of 'mail1.ourdomain.com'
because the self-signed certificate with thumbprint '6F22A6F3452CCCBFDC4D2012DF5770EB0339F9F4' takes precedence. The
following receive/send connectors match that FQDN: Default MAIL1, Client MAIL1.
WARNING: This certificate with thumbprint FFD02E87BD29D6C3ED9C7497CF6304F7BFB4364F and subject '*.ourdomain.com'
cannot used for POP SSL/TLS connections because the subject is not a Fully Qualified Domain Name (FQDN). Use command
Set-POPSettings to set X509CertificateName to the FQDN of the service.

 

[snootalope]

also, after enabling it via the command line, the same invalid for exchange server usage message is still there..

 

[snootalope]

Go this working. When I downloaded the cert originally I choose to use it on IIS6 - I re-keyed and dl'd it again as IIS7 and the message is gone.