Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've read this, and I'm still not 100% on this.

If our Exchange server is hosting email for multiple authoritative domains, do I need matching SAN names on the SSL certificate for each one?

In our setup the AD domain is company.local, the email domain for most people is, but we also have some people that have email addresses

So when I buy the SSL certificate, I assume I would need:


Is that right?

share|improve this question
up vote 3 down vote accepted

Apart from the required internal FQDN's and server names, you only need the domains on your certificate that you need to securely access your server on (OWA or ActiveSync for example). Your Exchange server can accept mail for any number of other domains, but if you only access OWA on then that is the only external DNS name that needs to be on the certificate.

As an example, our Exchange server accepts mail for about 30 domains, but we only have the following things on our certificate (pardon the whole Acme Widgets thing, but you get the idea).

svr03                               (Internal server name)               (OWA domain)  (AutoDiscover internal FQDN)       (AutoDiscover external FQDN)             (Legacy domain)         (Internal FQDN)

If I recall correctly, when I was going through the Exchange certificate wizard it did include all of our auxiliary domains, but I chose to remove them. It shouldn't hurt to leave them on, and if the certificate wizard includes them by default, it's certainly not wrong to leave them.

share|improve this answer
Thanks. I'm still in the planning phase, so running the certificate wizard isn't an option right now. Obviously, the more alternate names I add the more expensive the certificate gets, hence the need to figure this out sooner rather than later. – ThatGraemeGuy May 3 '11 at 13:23
If you have it set up this way, does AutoDiscover still work for users whose email address is not in the domain? From what I understand, it shouldn't but maybe I'm missing something? – ThatGraemeGuy May 4 '11 at 7:20
@Graeme that's a very good question. I'm inclined to say for AutoDiscover to work, the domain will need to be on the certificate, but without testing it I wouldn't like to say for certain. That might explain a bit better why the behaviour of the certificate wizard is to add all your accepted domains though. I guess I'm lucky that all my primary email addresses are so I don't run into this issue. – Ben Pilbrow May 4 '11 at 11:10
Hmmmm I guess a little testing is in order. Will fire up a VM and play around a bit. – ThatGraemeGuy May 4 '11 at 12:22

Actually if you reconfigure your Exchange correctly you can make use of only one domain / certificate (for example for both internal and external access. However then your owa / outlook configuration will always have to point to this chosen domain name. This is simplest/cheapest scenario.
This link can help you to setup Exchange 2010 to use only one domain for everything. Otherwise if you want to keep using different domain names for different people you need to use SAN certificate. This can be expensive solution.

One domain solution for everything (internal / external access) can even be cheaper by using completely free certificates from StartSsl for 1 year (extended every year for free). If general company name is too big problem (this could be an issue if your employees wouldn't feel right by accessing while being from IBM and vice versa - although I doubt this would be a problem in your case) you could always buy some unrelated domain name to the company's name like or something similar and use that. Then neither employees from legacy company or new company will complain.

share|improve this answer
There's no "legacy" company, the legacy hostname is required for Exchange 2007/2010 co-existence. AFAIK, clients supporting AutoDiscover will look for if the email address is Doesn't using 1 name break AutoDiscover? – ThatGraemeGuy May 4 '11 at 7:18
I've followed this Microsoft Article and it seems to work fine for 2 of my clients. – MadBoy May 4 '11 at 7:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.