Effects of changing from basic auth to cert based auth?

Question

I have been doing a bit of research on how to solve some frustrations our users have with mobile email and it looks like changing the Exchange settings to allow cert-based auth will help. I have been able to find plenty of instructions on how to set this up but the thing I have to demonstrate to our messaging team is that this is a low-risk proposition. What, if any, problems could we expect to see if we allow client certificates in addition to basic authentication?

For some context, we have an Exchange 2007 deployment and our users are connecting via ActiveSync. We are using an EMM platform to manage the email configuration and distribution of the client certificates so I only really need help finding information on what side effects may crop up on the Exchange server itself if we make this change.

Answer 1

Getting to the bottom of this took quite a bit of time and involved some conversations with our Microsoft rep. While there is an option to enable both cert-based auth and NTLM, it would require some bubble capacity because we would need one CAS cluster to handle requests authenticating with NTLM and another to handle the requests using cert-based auth. It's my understanding that this is because of an IIS limitation, but I am fuzzy on the details here.

This applies to Exchange 2010 as well as 2007.