Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Out of curiosity: what's the reason behind this?

To be clear: I've checked a couple of root CA's websites while searching for an appropriate SSL Cert (that's another story). Every single one of them illustrates the usefullness of Multidomain Certs with MS Exchange Server's need.

share|improve this question
    
In future you might want to wait a while before accepting an answer to your question, maybe a day or two. –  ThatGraemeGuy Feb 10 '11 at 20:33

2 Answers 2

up vote 2 down vote accepted

Usually because various application and naming conventions use different external names. Outlook RPC over HTTPS looks for autodiscover.domain.com, webmail usually points to webmail.domain.com, SMTP name might be presented like mail.domain.com

share|improve this answer
    
Thanks, that sheds some light in the dark. But then again, this sounds like a perfect application for Wildcard Certs ... just wondering. –  frombor Feb 10 '11 at 20:22
    
Well, not exactly. It very much depends what roles will do the Exchange server you're planning installing a certificate on. For example getting a wild card cert for a single-server scenario might require adding an external DNS zone along with the internal one. –  Vick Vega Feb 10 '11 at 20:29
2  
Wildcard certificates are not supported by some versions of Windows Mobile. While that may not be a concern now, at the time Exchange 2007 was released, it was, hence the official line was that a wildcard was not the way to do it. –  ThatGraemeGuy Feb 10 '11 at 20:31
    
The good thing about wild card is that you can export it and install on any external server of the domain. Some customers found it valuable. –  Vick Vega Feb 10 '11 at 20:34

Wildcard certificates are useful if you have many subdomains that you want to serve out.

Or you can have a SAN/UCC SSL Certificate from a third party for:
- mail.yourdomain.com
- autodiscover.yourdomain.com
- exchange.yourdomain.local
- remote.yourdomain.local <-- VPN/RDP access.

With the new announcement that the coming IIS8 will support SNI (http://blogs.iis.net/wonyoo/archive/2012/03/01/iis-8-0-platform-features-for-web-hosters-and-service-providers.aspx), this will probably change the way we apply certificates for exchange and everything else. In the future we could switch from using a Wildcard or UCC to using a single SSL cert for each SSL application we have, and a UCC one for Exchange.

More on SNI in IIS8:

IIS 8.0 support Server Name Indication (SNI), which has extended TLS to include the virtual domain name to be passed from the client at the time of "SSL Hello". This effectively allows IIS 8.0 to enable "hostname binding" for SSL sites, which eliminates the need for having a dedicated IPv4 address per SSL site.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.