Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've generated free certificate at StartCom for external OWA usage Problem is after installing it in Exchange, local users started getting errors from Outlook that Exchange.domain.local doesn't match the certificate name. Is there a way to use 2 different certificates. One for local usage thru Outlook MAPI and one for external usage thru OWA? It seemed to work fine with Exchange 2003 without a problem.

share|improve this question
up vote 1 down vote accepted

NETBIOS name of Exchange : ExchangeServerName
Internal FQDN (AD name) : exchangeserver.local
External FQDN (Public name) :
Autodiscover name :
SubjectName :

You should have the above on a Self Signed Certificate to work properly and you won't have that warning. Internal FQDN Name should be there.

In Exchange 2010, there is a certificate wizard via EMC (Exch. Mgmt. Console)
I would recommend to follow the tutorial on the link below (good one) :

Hope that Helps

share|improve this answer
Well problem is the self signed certificate works fine alone. Just when i generate new certificate request and validate it on outside and then assign the new certificate it stops working (well it still works just claims the the certificate is ok, just doesn't match the name). The remote access works fine with new certificate thou. – MadBoy Dec 10 '10 at 11:43
follow the link - as when you generated the certificate you forgot to mention the internal exchange fqdn - hence it's prompting you. once you have followed the link tutorial and generated one accordingly, enable it and the error should go away. – rihatum Dec 10 '10 at 11:44
Well I did follow similar link and all the settings were correct, i even did it once again using other domain name (since i can't revoke cert for free) and the problem was the same. I was using exchange.domain.local for Local access and for Internet, for autodiscover i had autodiscover.domain.local i think – MadBoy Dec 10 '10 at 12:15
Seems like i will need SAN Certificate to cover all domains (internal + external) and your answer touches Self Signed certificate. – MadBoy Dec 10 '10 at 12:25
Correct - even if you are using self signed or trusted authority cert, you would need a SAN certificate (Subject Alternative Names) so your domain listed in all its possibilities used on your internal / external network. I thought you were intending to use a self signed one - hence the link or you could use digicert and generate a san cert request. – rihatum Dec 10 '10 at 12:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.