0

recently setup certificate services on a windows server 2008 internal network.

I setup certificate services, generated the certificate, put it in the domain's trusted certificate folder and applied the certificate as a group policy for computer > windows settings > security. The certificate manager is setup as standalone root.

The problem is that the domain is setup as one that doesn't correspond to a web domain. So we expose our exchange webmail on an external IP using virtual hosts. An external dns manager resolves A records for related subdomains on these external IPs.

When a user visits our HTTPS exposed webmail, or terminal services, he/she gets a warning about an untrusted certificate as the certificate specifies the internal domain (premiernic.com), not the external (premier.com.cy).

I would like the external domain name to be trusted in the same way, through group policy. How do I go about this?

Improve this question

1 Answer 1

Reset to default
0

If all your clients are controlled by you, and you have trusted the root cert on all clients, you can just issue a new certificate to the Exchange Server which includes both names as a SAN entry. Have a look here for instructions how.

After installing and enabling this certificate on the Exchange Server, all clients that trust your root CA certificate will accept this certificate for both domain names.

If you have external clients (non-domain-clients) which do not trust your root CA, they will still get cert warnings / issues. You would need a certificate from a public CA then.

Also, as another variant, you can set exchange that it uses the same (external) domain for internal clients as well, and use a certificate with the external name only. Have a look at this question for details:

Get-WebServicesVirtualDirectory | Fl Identity,InternalUrl,BasicAuthenticationExternalUrl
Get-OabVirtualDirectory | Fl Identity,InternalURL,ExternalURL
Get-ActiveSyncVirtualDirectory | Fl Identity,InternalUrl,ExternalUrl
Get-OutlookAnywhere | Fl Server,ExternalHostname
Get-ClientAccessServer | Fl Server,AutoDiscoverServiceInternalURI
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .