Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any critical drawback in using an internal CA to release an Exchange 2007/2010 SAN certificate for a production environment?

share|improve this question
up vote 3 down vote accepted

Yes. There's more setup involved when working on non-domain computers.

RPC over HTTP requires a trusted certificate. So if you use your own, you have to install the root on each computer that is going to use this technology. With AD, not a big deal. Without AD (like for employee computers at home) it's really just a pain. With autodiscover, most users can now setup their own email easily. If you're using a self signed cert, that's no longer the case.

There's also a case to be made regarding security. You don't want your users to get used to clicking past certificate errors when they're using OWA on an outside computer. What happens on the day that that certificate error is caused by a man in the middle attack?

Certificates are really cheap nowadays. I think I just spent $150 on a 3 year SAN certificate. So just pay the money for the cert.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.