Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an existing internal domain with extension .internal

The .internal extension has been in-place for years and the AD has over 90 users with a linked to Exchange 2007 email accounts.

We now have a need to use signed SSL certificates, these need to be trusted by a third party. We are having difficulty locating a CA who will certify the .internal domain which is to some extent fair enough.

As I see it we have two choices:

One create an internal CA and persuade the 3rd party to add this to their own trusted root store (unlikely)

Two migrate the domain to .local. Does anyone have any experience of this, I know there is a procedure to rename a domain on AD but this does not seem to support Exchange.

share|improve this question
What does RFD in your title mean? – MDMarra Sep 28 '11 at 11:12
You don't say what you need to use SSL certificates for. That information might help us better understand your problem and allow us to offer alternative solutions. – joeqwerty Sep 28 '11 at 11:16
I'm curious (as we're planning to use .local).. Do you have some kind of verification that this would have worked with a .local domain? – pauska Sep 28 '11 at 11:41
RFD means I can't type :) RFC see link – RichardP Sep 28 '11 at 12:39
@RichardP .local actually isn't reserved in RFC2606 and the tlds and 2nd levels that are reserved are reserved explicitly for testing. – MDMarra Sep 28 '11 at 14:00
up vote 2 down vote accepted

.local is just as bad as .internal! You should use a third level subdomain that you actually own like where is your real legit ICANN (or whatever) registered domain name.

You are right about not being able to rename the domain with Exchange installed. After you have a new domain in place with the right domain name, you can use ADMT to perform a cross-forest migration of users, groups, computers, and servers. You're going to have to do a cross-forest migration of Exchange, too, which can be painful but there are tons of tools out there to do that for you.

share|improve this answer

Just a quick addtional note. Verisign were able to issue a certificate for a domain ending .internal. So if you want to avoid an AD migration (and who doesn't) then there are alternatives.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.