Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have been using an Exchange 2010 mail server for a year now. Today the certificates used in Exchange, as well as of Forefront TMG expired.

We had the following certificate chain: Root CA issued a sub CA a certificate that has expired today as well.

SubCA issued a whole bunch of certificates (in the issued list), but from what I understand, the main is CSPO and CA certificate.

I have access to all servers in pay for mailflow: RootCA, SubCA, Exchange, Forefront.

What will be the outline of actions I need to take, to get back the mail running?

Thank you.

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

I ended up figuring out the solution myself.

The steps I needed to take are:

  1. Request a new CA certificate for SubCA from a RootCA.
  2. Renew the OCSP certificate for OCSP Responders to work properly

    certutil -setreg ca\UseDefinedCACertInRequest 1

  3. Renew the Exhcange server certificate by:

a) Creating a renew request on an expired certificate in EMC. Result -> *.req file. b) Copy the req file to a SubCA. c) Run the following command on SubCA

certreq -submit -attrib "CertificateTemplate: WebServer" myreqfilename

Result -> *.cer file generated.

d) copy the cer file to EMC computer and use it to finish the new certificate enrollment request.

  1. Assign POP, IMAP, SMTP and IIS services to this certificate in EMC
  2. Export this renewed certificate with a private key in EMC. Result -> *.pfx file.
  3. Import the pfx into the Local Machine personal certificate store on Forefront TMG
  4. Assign a new certificate to all OWA publishing rules.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.