Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I feel like I must be doing something quite stupid but I can't figure out what.

I have a UCC cert for email1.domain.com, email2.domain.com, webmail.domain.com

I have two CAS servers email1.domain.com and email2.domain.com they aren't using Microsoft NLB.

I generated the CSR on email1.domain.com and all went well with importing as well. When I try to import it to email2.domain.com I get the following error.

[PS] C:\Windows\System32>Enable-ExchangeCertificate -Thumbprint XYZ -Services "SMTP, IIS" Enable-ExchangeCertificate : The certificate with thumbprint XYZ was found but is not valid for use with Exchange Server (reason: PrivateKeyMissing). At line:1 char:27 + Enable-ExchangeCertificate <<<< -Thumbprint XYZ -Services "SMTP, IIS"

I have tried certutil -repairstore my "certserial#" and re-importing cert

If it matters this is a GoDaddy UCC cert. Should I also be adding autodiscover.domain.com to the cert as well for Outlook Anywhere?

Thanks,

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Your problem is that the second server, the one you didn't generate the csr on, does not have the private key for the cert and so can't use it. The easiest option is to export the cert from the first server as a pfx file, with the private key then import on the second.

share|improve this answer
    
Do these directions seem to outline just what I need to do? digicert.com/ssl-support/pfx-import-export-exchange-2007.htm –  PHLiGHT Sep 1 '10 at 3:40
    
Yes, that should do what you need. –  Sam Sep 1 '10 at 6:13
    
Thanks, that did the trick. I wish digicert's prices were closer to GoDaddy's because they have excellent support docs. GoDaddy said I was pretty much on my own and would need to contact Microsoft for help. –  PHLiGHT Sep 1 '10 at 12:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.