1

Out of curiosity: what's the reason behind this?

To be clear: I've checked a couple of root CA's websites while searching for an appropriate SSL Cert (that's another story). Every single one of them illustrates the usefullness of Multidomain Certs with MS Exchange Server's need.

1
  • In future you might want to wait a while before accepting an answer to your question, maybe a day or two. Feb 10, 2011 at 20:33

2 Answers 2

2

Usually because various application and naming conventions use different external names. Outlook RPC over HTTPS looks for autodiscover.domain.com, webmail usually points to webmail.domain.com, SMTP name might be presented like mail.domain.com

4
  • Thanks, that sheds some light in the dark. But then again, this sounds like a perfect application for Wildcard Certs ... just wondering.
    – frombor
    Feb 10, 2011 at 20:22
  • Well, not exactly. It very much depends what roles will do the Exchange server you're planning installing a certificate on. For example getting a wild card cert for a single-server scenario might require adding an external DNS zone along with the internal one.
    – Vick Vega
    Feb 10, 2011 at 20:29
  • 2
    Wildcard certificates are not supported by some versions of Windows Mobile. While that may not be a concern now, at the time Exchange 2007 was released, it was, hence the official line was that a wildcard was not the way to do it. Feb 10, 2011 at 20:31
  • The good thing about wild card is that you can export it and install on any external server of the domain. Some customers found it valuable.
    – Vick Vega
    Feb 10, 2011 at 20:34
0

Wildcard certificates are useful if you have many subdomains that you want to serve out.

Or you can have a SAN/UCC SSL Certificate from a third party for:
- mail.yourdomain.com
- autodiscover.yourdomain.com
- exchange.yourdomain.local
- remote.yourdomain.local <-- VPN/RDP access.

With the new announcement that the coming IIS8 will support SNI (http://blogs.iis.net/wonyoo/archive/2012/03/01/iis-8-0-platform-features-for-web-hosters-and-service-providers.aspx), this will probably change the way we apply certificates for exchange and everything else. In the future we could switch from using a Wildcard or UCC to using a single SSL cert for each SSL application we have, and a UCC one for Exchange.

More on SNI in IIS8:

IIS 8.0 support Server Name Indication (SNI), which has extended TLS to include the virtual domain name to be passed from the client at the time of "SSL Hello". This effectively allows IIS 8.0 to enable "hostname binding" for SSL sites, which eliminates the need for having a dedicated IPv4 address per SSL site.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .