Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've previously successfully set up Exchange 2010 with a wildcard certificate, but I remember it wasn't exactly straightforward. I'm also more familiar with generating CSRs with openssl than Windows tools. My question is in two parts:

  1. would life be simpler if I did not use a wildcard cert?
  2. can I use a certificate in Exchange if I've had it issued against a CSR generated with openssl?
share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

We use a web-based front-end to OpenSSL to generate the CSR and private key, and the same tool to build the PFX from the key and issued certificate. Works great.

NOTE: A configuration change is required for legacy clients if you use a wildcard certificate: http://technet.microsoft.com/en-us/library/cc535023(v=exchg.80).aspx

You can either generate a wildcard certificate for your email domain, or a unified communications/SAN certificate. If you aren't sure which subject alternative names to include in the UC certificate, you may want to use the wizard in the EMC to generate your CSR. Be sure to include any publicly accessible client-access hostnames and autodiscover.domain.com. Also include your send connector FQDNs if you want to utilize TLS for transport.

share|improve this answer
    
does this achieve the same thing as your tool? –  Jack Douglas Apr 10 '13 at 17:11
    
hard to see links in comments here isn't it? –  Jack Douglas Apr 10 '13 at 17:12
1  
It is hard to see links in comments, which is why I've resorted to pasting URLs instead of hyperlinking. It looks like they do use the same parameters: /usr/bin/openssl pkcs12 -export -in /path/to/server.crt -inkey /path/to/server.key -certfile /path/to/cabundle.crt -out /path/to/new/server.pfx -passout file:/path/to/password.txt –  Jeremy Lyons Apr 10 '13 at 17:48
    
excellent, thanks! –  Jack Douglas Apr 10 '13 at 17:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.