Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hardware/software info

Server 2008 R2 64 bit

IIS 7

Exchange 2010

Issues and steps taken:

I have imported my Godaddy wildcard cert, and all intermediate certs related to the wildcard cert, into the server.

I have changed the Exchange IIS 7 sites to use mail.domain.com and servername.domain.com appropriately. (This includes adding the correct names.)

Going to hxxps://mail.domain.com - everything works perfectly. Going to (internal) servername.domain.c0m gets me to the log in page with the wildcard cert and no warnings. When I log in, I get a broken page. It’s as if I was offline.

Trying to use my droid to connect and get email gives me the following error "Network not available:

I changed all of these without changing the cert for Exchange and got the above results. (I was making just one change at a time for easier diagnosis if something goes wrong.)

In Exchange 2010 the old cert has the following services on it: IMAP, POP, IIS, SMTP I tried to assign the same services to the new wildcard cert, but it would not take all of the services away from the old cert. Do I need to delete the old cert before I can assign the new cert these services?

I have put everything back to the old cert and all is well again. I have to get this changed over fairly soon, as time is running out on the old cert.

share|improve this question
4  
Please refrain from asking us to give you "complete steps" because of your inability to do your own work. We're not being paid for helping out. –  pauska Mar 12 '12 at 14:42
add comment

4 Answers

Wildcard certificates are known to cause problems with many different devices and operating systems. I strongly suggest that you switch over to a UCC-certificate from a known vendor.

share|improve this answer
    
+1. I had exactly the same problem with the same setup. I got my $ back from GoDaddy and bought one from a well-known and expensive vendor and it works perfectly. The problem was that the mobile devices we're using did not trust the root CA used to sign the GoDaddy cert. –  Paul Ackerman Mar 12 '12 at 18:13
add comment

Microsoft recommends to use SAN certificates with Exchange 2010 instead of wildcard certificates: http://technet.microsoft.com/en-us/library/dd351044.aspx#digitalcertificatesbestpractices

share|improve this answer
    
Agreed, a SAN cert is the way to go. –  Tatas Mar 12 '12 at 16:35
    
We bought the wildcard cert to avoid lots of different certs. I hate to go back if I do not have too...Others have it working using a wildcard cert, and I had all but the internal OWA site working. Any other thoughts on this? - Thanks. –  OneGuy Mar 12 '12 at 19:09
add comment

I had the same exact Issue and this is how I fixed it.

  1. I restarted all the exchange services [Didn't help]

  2. I followed this instruction http://exchangeserverpro.com/exchange-server-2010-certificate-invalid-for-exchange-server-usage-error/ [Didn't work but helped me get there]

  3. Follow the step 2 for the mmc console and browse to Certificates(local Computer)> Trused Root Certification Authorities > Certificates > "This is where you will have to find your intermideate cert that came with your *wild card cert" after you locate the cert right click and property and allow for all purpose or allow all

Go back to your EMC > Microsoft exchange >Server Configuration to verify

share|improve this answer
add comment

Most customers that I have seen that work with Exchange go with the UCC. Wildcards, although feasible (certain things have to align like the domain must be the same and only differ by subdomain), cause many problems and the cost difference for many is just not worth it. In addition, there are UCC certs now that are cheaper than wildcards, albeit they may limit the number of domains (and by extension subdomains). Many choices out there.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.