Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I got the following message The STARTTLS certificate will expire soon. Now I tried to create new certificates, but currently the old ones are still used.

Questions:

  • Can I backup the old certificate somehow (in case I remove one but missed a thing)?
  • Does a service can be assigned to only one certificate? (I always get the notice that another certificate is getting priority) And can I delete the other one with the same assigned service?
  • Can I delete certificates with the status DateInvalid?
  • Can I delete certificates with no services assigned?

Now the certificates which have to be replaced.

Case 1:

Old one:

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {Sites, servername.domain.local}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=domain-servername-CA
NotAfter           : 24.08.2012 08:55:23
NotBefore          : 25.08.2010 08:55:23
PublicKeySize      : 2048
RootCAType         : Registry
SerialNumber       : 486D0BC600000000500C
Services           : IIS, SMTP
Status             : Valid
Subject            : CN=Sites
Thumbprint         : 8E1C89B67081472F6A9C1FB9C1745XC351D8C74D

Replacement:

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {Sites, servername.domain.local}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : CN=Sites
NotAfter           : 30.07.2017 12:41:34
NotBefore          : 30.07.2012 12:41:34
PublicKeySize      : 2048
RootCAType         : None
SerialNumber       : AAFC94772E6BFF8E4AE9812226240927
Services           : IIS, SMTP
Status             : Valid
Subject            : CN=Sites
Thumbprint         : 587B9GE9C313923CFFAB6430DEDE729EE0D575C0

Notable differences:

  • self signed is true
  • issuer is different
  • two times: System.Security.AccessControl.CryptoKeyAccessRule

Case 2:

Old one:

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {mail.domain.com, many further domains}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=servername-domain-CA
NotAfter           : 17.08.2012 15:37:50
NotBefore          : 18.08.2010 15:37:50
PublicKeySize      : 2048
RootCAType         : Registry
SerialNumber       : 56329D6600000000000D
Services           : IMAP, POP, SMTP
Status             : Valid
Subject            : CN=mail.domain.com, OU=Technics, O=Organisation, L=Location, C
                     =CC
Thumbprint         : BE348A18EB1EED4E182E3C9AF2E7577ADD6EF669

Replacement:

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {mail.domain.com, many further domains}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : C=CC, L=Location, O=Organisation, OU=Technics, CN=mail.domain
                     .com
NotAfter           : 30.07.2017 12:17:33
NotBefore          : 30.07.2012 12:17:33
PublicKeySize      : 2048
RootCAType         : None
SerialNumber       : A9A4E319D016B296488457C8FB7DF8B7
Services           : IMAP, POP, SMTP
Status             : Valid
Subject            : C=CC, L=Location, O=Organisation, OU=Technics, CN=mail.domain
                     .com
Thumbprint         : 2BEFBDD484FEFB3F594F2C84B7DA16DC3C05875D

Notable differences:

  • self signed is true
  • issuer is different
  • two times: System.Security.AccessControl.CryptoKeyAccessRule
  • order of subject is different

Now my question to these certificates:

  • Can I ignore the differences?
  • For the replacements: Can I delete the old certificates and all would still work (e.g. Outlook Web Access)?
share|improve this question

1 Answer 1

For Exchange 2007, you can use this tool from U-BTech to manager your certificates. They have a screen-shot guide. http://www.u-btech.com/products/certificate-manager-for-exchange-2007.html

To answer your question:

  1. Can you ignore the differences > NO.
  2. Can you delete the old Cert > You shouldn't delete the old-cert from a third-party provider and replace it with a self-signed cert.

You would want to keep the cert which has IsSelfSigned: False for TLS to work. Also, you will have to renew the Third-party issued certificate from the cert-provider for the "Old One", as it's expiring in a week's time.

PS: You shouldnt post your Cert Serial and Thumbprint on the Tubes :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.