1

I got the following message The STARTTLS certificate will expire soon. Now I tried to create new certificates, but currently the old ones are still used.

Questions:

  • Can I backup the old certificate somehow (in case I remove one but missed a thing)?
  • Does a service can be assigned to only one certificate? (I always get the notice that another certificate is getting priority) And can I delete the other one with the same assigned service?
  • Can I delete certificates with the status DateInvalid?
  • Can I delete certificates with no services assigned?

Now the certificates which have to be replaced.

Case 1:

Old one:

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {Sites, servername.domain.local}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=domain-servername-CA
NotAfter           : 24.08.2012 08:55:23
NotBefore          : 25.08.2010 08:55:23
PublicKeySize      : 2048
RootCAType         : Registry
SerialNumber       : 486D0BC600000000500C
Services           : IIS, SMTP
Status             : Valid
Subject            : CN=Sites
Thumbprint         : 5XY3E4589CDEE54C1FB9C1745XC351D8C74D

Replacement:

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {Sites, servername.domain.local}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : CN=Sites
NotAfter           : 30.07.2017 12:41:34
NotBefore          : 30.07.2012 12:41:34
PublicKeySize      : 2048
RootCAType         : None
SerialNumber       : AAFC94772E6BFF8E4AE9812226240927
Services           : IIS, SMTP
Status             : Valid
Subject            : CN=Sites
Thumbprint         : 98732EASYDFGC4336430DEDE729EE0D575C0

Notable differences:

  • self signed is true
  • issuer is different
  • two times: System.Security.AccessControl.CryptoKeyAccessRule

Case 2:

Old one:

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {mail.domain.com, many further domains}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=servername-domain-CA
NotAfter           : 17.08.2012 15:37:50
NotBefore          : 18.08.2010 15:37:50
PublicKeySize      : 2048
RootCAType         : Registry
SerialNumber       : 56329D6600000000000D
Services           : IMAP, POP, SMTP
Status             : Valid
Subject            : CN=mail.domain.com, OU=Technics, O=Organisation, L=Location, C
                     =CC
Thumbprint         : A8329DCD493FLIE2E3C9AF2E7577ADD6EF669

Replacement:

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {mail.domain.com, many further domains}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : C=CC, L=Location, O=Organisation, OU=Technics, CN=mail.domain
                     .com
NotAfter           : 30.07.2017 12:17:33
NotBefore          : 30.07.2012 12:17:33
PublicKeySize      : 2048
RootCAType         : None
SerialNumber       : A9A4E319D016B296488457C8FB7DF8B7
Services           : IMAP, POP, SMTP
Status             : Valid
Subject            : C=CC, L=Location, O=Organisation, OU=Technics, CN=mail.domain
                     .com
Thumbprint         : 83EKDFKLIO483ZH94F2C84B7DA16DC3C05875D

Notable differences:

  • self signed is true
  • issuer is different
  • two times: System.Security.AccessControl.CryptoKeyAccessRule
  • order of subject is different

Now my question to these certificates:

  • Can I ignore the differences?
  • For the replacements: Can I delete the old certificates and all would still work (e.g. Outlook Web Access)?
Improve this question

1 Answer 1

Reset to default
1

For Exchange 2007, you can use this tool from U-BTech to manager your certificates. They have a screen-shot guide. http://www.u-btech.com/products/certificate-manager-for-exchange-2007.html

To answer your question:

  1. Can you ignore the differences > NO.
  2. Can you delete the old Cert > You shouldn't delete the old-cert from a third-party provider and replace it with a self-signed cert.

You would want to keep the cert which has IsSelfSigned: False for TLS to work. Also, you will have to renew the Third-party issued certificate from the cert-provider for the "Old One", as it's expiring in a week's time.

PS: You shouldnt post your Cert Serial and Thumbprint on the Tubes :)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .