SSL Certificate Installation for Small Business Server 2011

Overview

Microsoft Small Business Server (SBS) 2011 is an all-in-one server solution that integrates IIS, Exchange 2010, SharePoint Foundation, and Remote Web Access. SSL certificate configuration in SBS is more involved than a standard IIS setup because the certificate must be correctly assigned to all integrated services.

Prerequisites

• Windows Small Business Server 2011 Standard
• Administrator access to the server
• A Subject Alternative Name (SAN) certificate from FairSSL, covering all required hostnames

Step 1: Plan hostnames for the SAN certificate

SBS 2011 typically utilizes several hostnames that all must be secured by the certificate:

• remote.eksempel.dk -- Remote Web Access (RWA)
• mail.eksempel.dk -- OWA, ActiveSync, Outlook Anywhere
• autodiscover.eksempel.dk -- Autodiscover (essential for Outlook and mobile devices)
• eksempel.dk -- Root domain (optional but recommended)

Important: Do not use a Wildcard certificate (*.eksempel.dk) with SBS 2011, as it often causes issues with Exchange Autodiscover and various SBS configuration wizards.

Step 2: Create the CSR

You can generate the Certificate Signing Request (CSR) using two different methods:

Method A: Using Exchange Management Shell (Recommended):

New-ExchangeCertificate -GenerateRequest `
  -SubjectName "c=DK, o=Eksempel A/S, cn=remote.eksempel.dk" `
  -DomainName remote.eksempel.dk, mail.eksempel.dk, autodiscover.eksempel.dk, eksempel.dk `
  -KeySize 2048 `
  -PrivateKeyExportable $true `
  -Path "C:\ssl\sbs-csr.req"

Method B: Using IIS Manager:

1. Open IIS Manager → select the server node → Server Certificates.
2. Click Create Certificate Request in the Actions panel on the right.
3. Enter your primary domain as the Common Name.
4. Note: The IIS Manager GUI only supports a single domain. Additional SAN hostnames are specified in the FairSSL control panel during the ordering process.

Submit the CSR text in the FairSSL control panel and ensure you select a SAN certificate that includes the necessary extra domains.

Step 3: Import the certificate

1. Open IIS Manager → server node → Server Certificates.
2. Click Complete Certificate Request.
3. Browse to the certificate file provided by FairSSL.
4. Enter a Friendly name (e.g. FairSSL SBS SAN 2026).
5. Select the Personal certificate store.

Ensure you also install the intermediate certificate via MMC (refer to our guide on intermediate certificates).

Step 4: Assign the certificate to Exchange services

# Locate the thumbprint for the new certificate
Get-ExchangeCertificate | Format-List Subject, Thumbprint, Services, NotAfter

# Assign to IIS (OWA, ActiveSync, Autodiscover) and SMTP
Enable-ExchangeCertificate -Thumbprint "YOUR-THUMBPRINT" -Services IIS,SMTP

Step 5: Update IIS bindings and SBS services

1. IIS Default Web Site: Update the HTTPS binding to use the new certificate (Site → Bindings → Edit HTTPS binding).
2. Remote Web Access: Open the SBS Console → Network → Remote Web Access → Repair. The SBS wizard should automatically apply the new certificate.
3. SharePoint: If you are using SharePoint via HTTPS, update its specific binding in IIS as well.

Warning: SBS wizards ("Fix my network", "Set up your Internet address") can occasionally reset SSL bindings to a self-signed certificate. Always verify your bindings manually after running an SBS wizard.

Step 6: Testing and validation

1. Remote Web Access: Navigate to https://remote.eksempel.dk -- the login page should load without certificate warnings.
2. OWA: Navigate to https://mail.eksempel.dk/owa and verify the certificate details.
3. Outlook: Test Autodiscover from an external Outlook client. Ctrl + Right-click the Outlook icon in the system tray → Test E-mail AutoConfiguration.
4. Mobile devices: Configure an Exchange account via ActiveSync and ensure no certificate errors are triggered.

# Quick verification of Exchange certificates
Get-ExchangeCertificate | Where {$_.Status -eq "Valid"} | Format-Table Subject, CertificateDomains, Services, NotAfter -AutoSize

Troubleshooting

• SBS wizard has overwritten the certificate: Repeat Steps 3-5. It is often best to avoid the "Fix My Network" wizard in a live production environment if possible.
• Autodiscover fails: Ensure that autodiscover.eksempel.dk is included in the SAN list and that the DNS record is pointing to the correct IP.
• Remote Web Access shows a self-signed cert: Run the Repair function in the SBS Console under Remote Web Access, then check the IIS bindings manually.
• Certificate renewal: Remember to manually update all services (Exchange, IIS, RWA) when installing a renewal certificate. SBS does not automate this process.