Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a single-server Exchange 2010 setup. In the early hours of this morning the server had a blue screen and rebooted. After coming back up the POP3/IMAP4 and Transport services are complaining that they cannot find the correct SSL certificate for mail.example.com.

POP3:

Log Name:      Application
Source:        MSExchangePOP3
Date:          2012/04/23 11:45:15 AM
Event ID:      2007
 Task Category: (1)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      exch01.domain.local
Description:
A certificate for the host name "mail.example.com" couldn't be found.
SSL or TLS encryption can't be made to the POP3 service.

IMAP4:

Log Name:      Application
Source:        MSExchangeIMAP4
Date:          2012/04/23 08:30:44 AM
Event ID:      2007
Task Category: (1)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      exch01.domain.local
Description:
A certificate for the host name "mail.example.com" couldn't be found.
Neither SSL or TLS encryption can be made to the IMAP service.

Transport:

Log Name:      Application
Source:        MSExchangeTransport
Date:          2012/04/23 08:32:27 AM
Event ID:      12014
Task Category: TransportService
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      exch01.domain.local
Description:
Microsoft Exchange could not find a certificate that contains the domain name 
mail.example.com in the personal store on the local computer. Therefore, it 
is unable to support the STARTTLS SMTP verb for the connector Default EXCH01 
with a FQDN parameter of mail.example.com. If the connector's FQDN is not 
specified, the computer's FQDN is used. Verify the connector configuration 
and the installed certificates to make sure that there is a certificate with
a domain name for that FQDN. If this certificate exists, run 
Enable-ExchangeCertificate -Services SMTP to make sure that the Microsoft 
Exchange Transport service has access to the certificate key.

The odd part is that Get-ExchangeCertificate show the cert as enabled for all the relevant services, and OWA is working flawlessly using this certificate.

[PS] C:\Users\graeme\Desktop>Get-ExchangeCertificate

Thumbprint                                Services   Subject
----------                                --------   -------
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX  ....S.     CN=exch01
YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY  ....S.     CN=exch01
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ  IP.WS.     CN=mail.example.com, OU=Domain Control Validated, O=mail.exa...

Here's the certificate in the computer account's personal cert store:

Does anyone have any pointers for getting POP3/IMAP4/SMTP to use the cert again?

share|improve this question
    
Does the certificate appear in the Certificates MMC snapin? –  Chris McKeown Apr 23 '12 at 7:50
    
@ChrisMcKeown: yes, added screenshot. –  ThatGraemeGuy Apr 23 '12 at 9:56
    
Is the SSL cert a wildcard certificate, or specifically for your mail.example.com address? –  Chris McKeown Apr 23 '12 at 10:11
    
No it's the exact name. It's been set up and working for months, its just suddenly started complaining after this box rebooted in the early hours of the morning. If I haven't found the answer by this evening I'm going to give it a reboot and see if its one of those weird inexplicable things that tend to happen. –  ThatGraemeGuy Apr 23 '12 at 10:49
    
Remove and re-add the cert? –  David Mar 24 at 19:45
show 1 more comment

2 Answers 2

  1. Run Enable-ExchangeCertificate -Thumbprint -Service POP , do the same for IMAP :) .
  2. Check that you have the certificate enabled on the CA server
share|improve this answer
    
Ran Enable-ExchangeCertificate and restarted the services, made no difference. Assuming the "CA" in #2 refers to the client access server, then yes this is done, it's a single-server setup. –  ThatGraemeGuy Apr 23 '12 at 9:48
    
Please check if you have the following services running : HTTPFilter ,Security accounts service , and the ports for : POP3 (110), IMAP(143),SMTP(25), SSMTP (465),IMAP SSL(585/993),SECURE pop3 - 995, openned. See for what purposes the certificate is enabled. –  Alex H Apr 23 '12 at 13:42
    
"Security Accounts Manager" is running. I see no service called HTTPFilter. There is no local firewall that would prevent traffic to/from these ports. The certificate is enabled for POP/IMAP/SMTP/IIS, as per the original question. –  ThatGraemeGuy Apr 24 '12 at 8:51
    
I am taking a wild guess , but have you seen if you are sending the correct DNS record like exch01.domain.local points to mycompany.blabla.com (you company DNS A entry / MX record ) ? Please see if you don't have other errors in event log that could help you solve the issue . –  Alex H Apr 24 '12 at 12:49
    
No, the DNS is fine. It's been configured and working 100% for months. The only thing that happened is that the box had a blue screen and rebooted in the middle of the night. Since that happened the only thing that seems to be able to use the cert is OWA. –  ThatGraemeGuy Apr 25 '12 at 12:06
add comment

I only verified the access of de Client Access Server to the internet and view in the EMC of Microsoft Exchange if the certificates are updated with no warnings.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.