You have a problem with certificates. They can be very tricky if you do not understand them. I am going to cut and past my internal document I created for me, however, if you are not highly technical, I suggest that you spend the $260 and have Microsoft walk you through it.
This is a guide from beginning to end, and is for self-signed certificates.
If you have a paid certificate from a certificate authority, you can bypass steps 1, and 7-11.
How to do a self-signed certificate in Exchange 2007 on Server 2003
- Install Certificate Services in Add/Remove Programs>Add/Remove Windows Components. Install it as an Enterprise Root CA.
- In the Exchange Management Shell run the following command: Get-ExchangeCertificate and take note of the thumbprints.
- Run the following command:
• New-ExchangeCertificate -DomainName yourservername.yourdomain.com, yourservername, autodiscover.yourdomain.com, mail.yourdomain.com -FriendlyName "Exchange SAN Certificate" -GenerateRequest:$True -Keysize 1024 -path c:\cert1.txt -privatekeyExportable:$true -subjectName "c=us, o=Exchange Server, CN=yourdomain.com" (It is important to add all the common names, internal and external, as in the example above there are 4...replace the yourservername and your domain as appropriate)
- Run the following command in a normal DOS box from the same directory as the cert1.txt file above: certreq -submit -attrib "CertificateTemplate: WebServer" cert1.txt (you will be asked to give it a name c:\temp\cert.cer, for example)
• If you get an error message about it not being trusted, restart the Certificate Services and try again.
- In the Exchange Management Shell run the following command: Import-ExchangeCertificate –path c:\temp\cert.cer (or whatever path and name you used) and note which thumbprint has been added when you run Get-ExchangeCertificate again. If you are unsure, re-run the Import-ExchangeCertificate –path c:\temp\cert.cer command, and it will tell you explicitly what thumbprint it is. You cannot just view the certificate’s properties to get this information.
- In the Exchange Management Shell run the following command: Enable-ExchangeCertificate -Services iis,pop,smtp,imap . It will ask you for a thumbprint. Cut and paste the new thumbprint and hit enter.
- Open the MMC and add the certificates snap-in for the Computer account. Import the c:\temp\cert.cer to the “Personal” store so it shows in the next step.
- In IIS 6, go to the web site that has OWA, usually the Default Web Site. Go to Properties>Directory Security>Server Certificate and remove the current certificate.
- In IIS 6, go to the web site that has OWA, usually the Default Web Site. Go to Properties>Directory Security>Server Certificate and select and install the new c:\temp\cert1.cer certificate.
- On the user’s computer, open the MMC and add the certificates snap-in for the Computer account. Import the c:\temp\cert.cer to the “Trusted Root Certification Authorities” store.
- Go to your OWA site and when you get the certificate error, import the certificate. Click on any level of the hierarchy that shows a red error and import it there. This should allow you to go to the OWA site directly, with no certificate error.
• If you still have problems, it may be necessary to follow the following document: http://support.microsoft.com/kb/940726
• You can check your URLs with the following commands:
o Get-ClientAccessServer |fl
o Get-WebServicesVirtualDirectory |fl
o Get-OABVirtualDirectory |fl
o Get-UMVirtualDirectory |fl