up vote 1 down vote favorite
share [g+] share [fb]

Last Friday I installed a new domain controller, and everything seemed to have went smoothly. Removed the old DC and everyone can still login and stuff like that. But since I have setup the new DC there seems to be a problem with the exchange 2010 server. It keeps giving me a certificate error when I try to do a lot of things such as repair an email account, set out of office messages, and a few others.Exchange Error

I get this error for the mailserver.local.company name.com and autodiscover.company name.com

Was there something I was suppose to do on the Exchange Server when I changed DC?

I also noticed that when I start to get this error, I can no longer remote into the servers on the network and I have to restart my computer. I'm not sure if that is related or if I should start a new question on that.

Any help or a link to an article on this would be very appreciated.

link|improve this question
70% accept rate
3  
Did the old DC by any chance host Certificate Services? Look at the certificate it's complaining about and see where the untrusted certificate is. It sounds to me like your old DC issued a certificate securing things relating to Exchange, and you removed the Certificate Authority and removed a root or intermediate certificate in the process. – Ben Pilbrow Dec 28 '11 at 14:32
I'm not sure how to check to see if a certificate is hosted off the server. – poconnor Dec 28 '11 at 14:41
view the certificate and see who the certificate was issued by. I don't have a Windows CA issued certificate handy, but IIRC it will say it was issued by the name of the computer - if that is the name of your old DC, that will tell you. If not, please let us know the name of the certificate which is not trusted. – Ben Pilbrow Dec 28 '11 at 14:49
I just had a realization on something, the rest of the problems that have showed up since the new DC, all seem to be focused around the computer names. The internal website that we access by computer name will stop working, but the public address will work. Can not login to computers by computer name, but can with IP address. I wonder if this is the problem with the certificate error. – poconnor Dec 28 '11 at 15:44
Sounds like you have some DNS issues going on. I think that deserves a new question of its own, since that's a whole different kettle of fish. – Ben Pilbrow Dec 28 '11 at 15:51
show 1 more comment
feedback

1 Answer

up vote 2 down vote accepted

Well, the dialog box tells you exactly what's wrong - your computer doesn't trust the certificate which it is being presented.

The reason your computer doesn't trust the certificate might be related to your old Domain Controller, but it might not. I suspect your old Domain Controller was hosting Certificate Services and was a trusted Certificate Authority for your company and it issued a certificate for Exchange services, and when you removed the old DC you removed a root or intermediate certificate in the process.

You need to look at the certificate being presented and see where in the chain the trust is broken. Like I said, I suspect a missing intermediate or root certificate issued by your old Certificate Authority on the Domain Controller you removed.

If that's the case, you can Install the Active Directory Certificate Services role on your new Domain Controller and create a new CA to replace the old one. Next, run through the Exchange certificate wizard and generate a CSR for your Exchange server. Give this to your CA on your Domain Controller, issue a certificate, import it into Exchange and assign it to Exchange services.

Alternatively, shell out a few hundred quid and get a certificate signed by a trusted authority like DigiCert and you won't have to worry about the hassle of managing your own Certificate Authority. The added bonus of this option is that if you have mobile devices using ActiveSync, they won't have to import your certificate because DigiCert's (or whoever you choose) certificate will likely already be installed on the device.

link|improve this answer
I'm pretty sure that we do have an external certificate from somebody, since we have the exchange web portal setup with an SSL cert. Is that the same thing? – poconnor Dec 28 '11 at 14:51
@poconnor: Not necessarily - you could have a load balancer in front of the exchange server(s) that does SSL offloading with their own certificate. But that's not something we can guess, you're the one who should know your environment. – pauska Dec 28 '11 at 14:54
If you mean OWA, then yes that can be secured either by an internal or external CA - it doesn't matter who the issuing CA is, only that your computer trusts it. Please look at the certificate chain and tell us the name of the untrusted certificate, which should help us determine what the issuing CA is. – Ben Pilbrow Dec 28 '11 at 14:55
And now since I lasted remoted into the old DC about 10 min ago, I can't get the error to pop up again. I restarted my computer and still no error. Could have remoting into the old DC have done something? – poconnor Dec 28 '11 at 15:07
@poconnor I doubt it very much (unless the machine was turned off and you just turned it back on). If the same certificate secured OWA, can you try browsing to that and see if your browser complains of a certificate error? – Ben Pilbrow Dec 28 '11 at 15:10
show 2 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.