Exchange 2010: SSL Certificate Installation

Complete guide to SSL certificate management on Exchange 2010: DNS planning, Split-DNS, CSR generation, certificate installation, and service activation.

Switching from internal to internet-valid server names

When an Exchange server is installed, the default configuration uses internal server names for communication. However, it is no longer possible to include internal server names in publicly issued SSL certificates. Since Exchange cannot use multiple certificates for the same service, we must use externally valid DNS names in the certificate.

Examples of internal server names:

• server01
• exch01.fairssl.local
• srv01.domain.lan
• localhost
• 192.168.100.10
• 10.0.0.10

This requires one or more DNS names that can be accessed both internally and externally, pointing to the Exchange server, and the Exchange server must be configured to recognise these names.

We recommend one of the following two common solutions.

Split-DNS

One DNS name (e.g. webmail.fairssl.com) resolves to the internal IP address of the Exchange server on the local network, while resolving to the public IP from the internet.

If you do not want to create the entire domain as a split-DNS zone, we recommend creating the server name itself as a sub-zone, thereby only having split-DNS for that specific name.

See the guide for setting up Split-DNS

Then configure the server's internal and external URLs to use this single name.

Two DNS names

Here, separate DNS names are used for internal and external access. This is common practice for companies that have created a sub-domain for their public presence, e.g. intern.fairssl.com.

For example, webmail.fairssl.com could point to the external IP, while exchangeint.fairssl.com points to the internal IP.

Once established, simply configure the Exchange internal and external URLs to these names.

Setting up Split-DNS

1. Log in to the Domain Controller with an administrator account.

2. Press Windows Key + R and type the following command to open DNS Manager:

dnsmgmt.msc

3. Right-click on Forward Lookup Zones and click New Zone.

4. Click Next.

Select Primary zone and Store the zone in Active Directory if available.

Click Next.

5. Select To all DNS servers running on domain controllers in this forest.

Click Next.

6. Type the DNS name the internal DNS should point to (e.g. mail.fairssl.dk).

You can also choose to use the domain (e.g. fairssl.dk), but then a host must be created for every single DNS name (see step 9).

Click Next.

7. Select Allow only secure dynamic updates.

Click Next.

Click Finish.

8. Right-click the new forward zone and click New Host (A or AAAA).

9. Leave Name blank.

Enter the internal IP address of the Exchange server.

If you have created a reverse lookup zone or plan to, tick Create associated pointer (PTR) record; otherwise, leave it blank.

Click Add Host.

10. If you chose to create a zone for the entire domain, follow the steps below. Remember to create an entry for all DNS names in use (e.g. www.domain.dk, vpn.domain.dk, login.domain.dk).

Type the DNS name without the domain in name (e.g. mail).

Enter the internal IP address of the Exchange server.

If you have created a reverse lookup zone or plan to, tick Create associated pointer (PTR) record; otherwise, leave it blank.

Configuring internal and external Exchange service URLs

To update the internal and external DNS names for all Exchange services, follow the steps below.

1. Log in to the Exchange server with the CAS role. Use an account that is a member of the "Exchange Administrators" group and the local "Administrators" group.

2. Launch Exchange Management Shell, right-click the shortcut, and select Run as Administrator.

3. Type the following command and press [ENTER]:

Get-ExchangeServer | fl name

4. Type the following command and press [ENTER]. SERVERNAVN is the name found in step 3. INTERNURL is the internal address for the mail server (e.g. exch01.fairssl.dk or mail.fairssl.dk). EKSTERNURL is the external address for the mail server without https:// (e.g. mail.fairssl.dk). Ensure you use quotation marks around the values:

$CASserver = "SERVERNAVN" ; $internalURL= "INTERNURL" ; $externalURL= "EKSTERNURL"

5. Copy or type the following commands and press [ENTER] to switch the addresses to internet-valid names (for the full script, see step 6):

Get-AutodiscoverVirtualDirectory -Server $CASserver | Set-AutodiscoverVirtualDirectory -InternalUrl "https://$internalURL/Autodiscover/Autodiscover.xml" -ExternalUrl "https://$externalURL/Autodiscover/Autodiscover.xml"

Get-ClientAccessServer -Identity $CASserver | Set-ClientAccessServer -AutoDiscoverServiceInternalUri "https://$internalURL/Autodiscover/Autodiscover.xml"

Get-WebservicesVirtualDirectory -Server $CASserver | Set-WebservicesVirtualDirectory -InternalUrl "https://$internalURL/Ews/Exchange.asmx" -ExternalUrl "https://$externalURL/Ews/Exchange.asmx"

Get-OabVirtualDirectory -Server $CASserver | Set-OabVirtualDirectory -InternalUrl "https://$internalURL/Oab" -ExternalUrl "https://$externalURL/Oab"

Get-OwaVirtualDirectory -Server $CASserver | Set-OwaVirtualDirectory -InternalUrl "https://$internalURL/Owa" -ExternalUrl "https://$externalURL/Owa"

Get-EcpVirtualDirectory -Server $CASserver | Set-EcpVirtualDirectory -InternalUrl "https://$internalURL/Ecp" -ExternalUrl "https://$externalURL/Ecp"

Get-ActiveSyncVirtualDirectory -Server $CASserver | Set-ActiveSyncVirtualDirectory -InternalUrl "https://$internalURL/Microsoft-Server-ActiveSync" -ExternalUrl "https://$externalURL/Microsoft-Server-ActiveSync"

6. The following combines all the above commands for easy copy/paste. If you followed step 5, there is no need to run this:

Get-AutodiscoverVirtualDirectory -Server $CASserver | Set-AutodiscoverVirtualDirectory -InternalUrl "https://$internalURL/Autodiscover/Autodiscover.xml" -ExternalUrl "https://$externalURL/Autodiscover/Autodiscover.xml" ; Get-ClientAccessServer -Identity $CASserver | Set-ClientAccessServer -AutoDiscoverServiceInternalUri "https://$internalURL/Autodiscover/Autodiscover.xml" ; Get-WebservicesVirtualDirectory -Server $CASserver | Set-WebservicesVirtualDirectory -InternalUrl "https://$internalURL/Ews/Exchange.asmx" -ExternalUrl "https://$externalURL/Ews/Exchange.asmx" ; Get-OabVirtualDirectory -Server $CASserver | Set-OabVirtualDirectory -InternalUrl "https://$internalURL/Oab" -ExternalUrl "https://$externalURL/Oab" ; Get-OwaVirtualDirectory -Server $CASserver | Set-OwaVirtualDirectory -InternalUrl "https://$internalURL/Owa" -ExternalUrl "https://$externalURL/Owa" ; Get-EcpVirtualDirectory -Server $CASserver | Set-EcpVirtualDirectory -InternalUrl "https://$internalURL/Ecp" -ExternalUrl "https://$externalURL/Ecp" ; Get-ActiveSyncVirtualDirectory -Server $CASserver | Set-ActiveSyncVirtualDirectory -InternalUrl "https://$internalURL/Microsoft-Server-ActiveSync" -ExternalUrl "https://$externalURL/Microsoft-Server-ActiveSync"

Generating a CSR for certificate ordering

1. Launch Exchange Management Shell, right-click the shortcut, and select Run as Administrator.

2. In the Exchange Management Shell, type the following command followed by [ENTER], defining the parameters with your specific information:

• SubjectName: Organisation details
• KeySize: Encryption bit length (use 2048)
• PrivateKeyExportable: Whether the certificate can be exported for backup

$CSR = New-ExchangeCertificate -GenerateRequest -SubjectName "CN=mail.fairssl.dk, O=FairSSL ApS, OU=IT Department, L=Oerum Djurs, S=Oerum Djurs, C=DK" -KeySize 2048 -PrivateKeyExportable $true

3. You can now copy the generated text directly into the certificate application, or use the following command to save it to a file:

• Path: The destination path for the CSR file

Set-Content -Path "c:\mail.fairssl.dk.csr" -value $CSR

4. Open the CSR in Notepad by typing the following command in the Exchange Management Shell, using the file path from above, followed by [ENTER]:

notepad c:\mail.fairssl.dk.csr

5. Select and copy the entire block of text, including all hyphens at the beginning and end.

Paste this text into the CSR field of your application.

Importing the Intermediate Certificate Authority

The following describes how to import intermediate certificates on a Microsoft Windows server, including Exchange. To ensure clients can validate the trust chain, the public intermediate certificate must be installed on the Exchange server.

Note that Windows sometimes installs this automatically during server certificate installation. Importing it manually does no harm; you will simply receive a warning if it is already present.

1. Log in to the server with an account that is a member of the local "Administrators" group.

Copy the intermediate certificate text from your certificate email into a plain text editor (such as Notepad). Save the file to the desktop as intermediate.cer.

2. Press Windows Key + R.

Type mmc.exe.

Click OK.

3. Click File and then Add/Remove snap-in.

4. Select Certificates and click Add.

5. Select Computer account and click Next>

6. Ensure Local computer is selected.

Click Finish.

Click OK.

7. Expand Certificates (Local Computer) and Intermediate Certification Authorities.

Right-click Certificates, select All Tasks, and click Import...

8. Click Browse... and select the file saved on the desktop.

Click Next.

9. Select Automatically select the certificate store based on the type of certificate.

Click Next.

Click Finish.

Importing and activating a certificate backup file (.PFX/PKCS12)

The following describes how to import and activate a certificate backup file in Exchange 2010. When ordering domains with AutoCSR, the certificate is received as a backup file protected by a unique code.

1. Launch Exchange Management Shell, right-click the shortcut, and select Run as Administrator.

2. In the Exchange Management Shell, type the following command followed by [ENTER]:

• Path: Path to the certificate file location.
• Services: The services you wish to activate.

Import-ExchangeCertificate -FileData ([Byte[]]$(Get-Content -Path c:\mail.mydomain.dk.pfx-Encoding byte-ReadCount 0))-password:(Get-Credential).password | Enable-ExchangeCertificate -Services "IIS,POP,IMAP,SMTP,None"

Add UM to services if Unified Messaging is installed.

If you select services that are not installed, the command will fail; only select services where the certificate will be used.

This command will first import the certificate and then activate the selected services.

A password prompt will appear if the file is password-protected (see step 3).

Finally, you will be asked if you want to switch the default certificate for SMTP; type y and press [ENTER].

3. A prompt for username and password will appear. Note that the username field is not used, but must contain a value.

Type None in the username field, and enter the file's protection password in the password field.

Activating the certificate for specific services

1. Launch Exchange Management Shell, right-click the shortcut, and select Run as Administrator.

2. Type the following command followed by [ENTER]:

• Thumbprint: The certificate ID (can be found using the command Get-ExchangeCertificate).
• Services: The services the certificate should be activated for.

Enable-ExchangeCertificate -Thumbprint -Services "IIS, POP, IMAP, SMTP, None"

Add UM to services if Unified Messaging is installed.

If you select services that are not installed, the command will fail; only select services where the certificate will be used.

You must then confirm that the SMTP service certificate should be replaced; press [ENTER] to accept.