Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got an exchange server behind behind a port to address translation firewall. The server is reachable from the internet using a dyndns-url.

Now I want to sync windows phones to exchange mailboxes. To achieve this, I need to install the exchange certificate on the windows phone (send it to the phone by mail, double click). So far so good.
But, as far as I can see this does only work if the certificate on my exchange server matches the dyndns-url?

So I'd like to know: how do I create a self signed certificate for my dyndns-url and install it on exchange?

share|improve this question
up vote 0 down vote accepted

even though you can have a self signed certificate, it will be good if you get a domain name and a proper ucc san cert from either godaddy or

create a UCC self-signed certificate. We will require the following names:

NETBIOS name of Exchange: EX-2k7 (example)

Internal FQDN: (example)

External FQDN (Public name): dyndns-hostname (example) (use nslookup/ping to verify the external FQDN)

Autodiscover name: autodiscover.dyndns-hostname (example)

SubjectName: cn=dyndns-hostname (example)

In EMS, run the following command to generate the new self-signed certificate:

New-ExchangeCertificate -FriendlyName "SelfSigned Cert2010" -SubjectName "cn=domain name" -DomainName server netbios name,server.domain.local,dyndns-hostname,, -PrivateKeyExportable $True

Next enable the certificate with Enable-ExchangeCertificate cmdlet. Enable atleast IIS and SMTP.

Enable-ExchangeCertificate -Thumbprint xxxxxxxxxxxxxxx -Services POP,IMAP,SMTP,IIS

Next verify certificate has been installed using EMS/IIS Manager or both. (Sometimes you may have to remove the certificate and then install/enable certificate again).

where dyndns-host name = for e.g. ""

Hope that Helps

share|improve this answer
I'd buy a certificate, but is it possible to use a real certificate on a dialup line with dynamic IP? A fixed IP is way too expensive at my provider. – Sam Nov 8 '10 at 13:26
Unless you write the actual IP address in the certificate it won't matter. The point of using a DNS entry for this is because the certificate matches against its common name and if the common name is a DNS entry, then it doesn't matter what IP it resolves to, you're never going to compare it. – gparent Mar 15 '12 at 18:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.