Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've read this, and I'm still not 100% on this.

If our Exchange server is hosting email for multiple authoritative domains, do I need matching SAN names on the SSL certificate for each one?

In our setup the AD domain is company.local, the email domain for most people is company.com, but we also have some people that have email addresses @othercompany.com.

So when I buy the SSL certificate, I assume I would need:

  • mail.company.com
  • autodiscover.company.com
  • legacy.company.com
  • mail.othercompany.com
  • autodiscover.othercompany.com
  • legacy.othercompany.com

Is that right?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Apart from the required internal FQDN's and server names, you only need the domains on your certificate that you need to securely access your server on (OWA or ActiveSync for example). Your Exchange server can accept mail for any number of other domains, but if you only access OWA on mail.acme-widgets.com then that is the only external DNS name that needs to be on the certificate.

As an example, our Exchange server accepts mail for about 30 domains, but we only have the following things on our certificate (pardon the whole Acme Widgets thing, but you get the idea).

svr03                               (Internal server name)
mail.acme-widgets.com               (OWA domain)
autodiscover.corp.acme-widgets.com  (AutoDiscover internal FQDN)
autodiscover.acme-widgets.com       (AutoDiscover external FQDN)
legacy.acme-widgets.com             (Legacy domain)
svr03.corp.acme-widgets.com         (Internal FQDN)

If I recall correctly, when I was going through the Exchange certificate wizard it did include all of our auxiliary domains, but I chose to remove them. It shouldn't hurt to leave them on, and if the certificate wizard includes them by default, it's certainly not wrong to leave them.

share|improve this answer
Thanks. I'm still in the planning phase, so running the certificate wizard isn't an option right now. Obviously, the more alternate names I add the more expensive the certificate gets, hence the need to figure this out sooner rather than later. –  ThatGraemeGuy May 3 '11 at 13:23
If you have it set up this way, does AutoDiscover still work for users whose email address is not in the acme-widgets.com domain? From what I understand, it shouldn't but maybe I'm missing something? –  ThatGraemeGuy May 4 '11 at 7:20
@Graeme that's a very good question. I'm inclined to say for AutoDiscover to work, the domain will need to be on the certificate, but without testing it I wouldn't like to say for certain. That might explain a bit better why the behaviour of the certificate wizard is to add all your accepted domains though. I guess I'm lucky that all my primary email addresses are @acme-widgets.com so I don't run into this issue. –  Ben Pilbrow May 4 '11 at 11:10
Hmmmm I guess a little testing is in order. Will fire up a VM and play around a bit. –  ThatGraemeGuy May 4 '11 at 12:22

Actually if you reconfigure your Exchange correctly you can make use of only one domain / certificate (for example mail.company.com) for both internal and external access. However then your owa / outlook configuration will always have to point to this chosen domain name. This is simplest/cheapest scenario.
This link can help you to setup Exchange 2010 to use only one domain for everything. Otherwise if you want to keep using different domain names for different people you need to use SAN certificate. This can be expensive solution.

One domain solution for everything (internal / external access) can even be cheaper by using completely free certificates from StartSsl for 1 year (extended every year for free). If general company name mail.company.com is too big problem (this could be an issue if your employees wouldn't feel right by accessing mail.microsoft.com while being from IBM and vice versa - although I doubt this would be a problem in your case) you could always buy some unrelated domain name to the company's name like mailserver.com or something similar and use that. Then neither employees from legacy company or new company will complain.

share|improve this answer
There's no "legacy" company, the legacy hostname is required for Exchange 2007/2010 co-existence. AFAIK, clients supporting AutoDiscover will look for autodiscover.example.com/bla if the email address is @example.com. Doesn't using 1 name break AutoDiscover? –  ThatGraemeGuy May 4 '11 at 7:18
I've followed this Microsoft Article and it seems to work fine for 2 of my clients. –  MadBoy May 4 '11 at 7:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.