1

We have a single-server Exchange 2010 setup. In the early hours of this morning the server had a blue screen and rebooted. After coming back up the POP3/IMAP4 and Transport services are complaining that they cannot find the correct SSL certificate for mail.example.com.

POP3:

Log Name:      Application
Source:        MSExchangePOP3
Date:          2012/04/23 11:45:15 AM
Event ID:      2007
 Task Category: (1)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      exch01.domain.local
Description:
A certificate for the host name "mail.example.com" couldn't be found.
SSL or TLS encryption can't be made to the POP3 service.

IMAP4:

Log Name:      Application
Source:        MSExchangeIMAP4
Date:          2012/04/23 08:30:44 AM
Event ID:      2007
Task Category: (1)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      exch01.domain.local
Description:
A certificate for the host name "mail.example.com" couldn't be found.
Neither SSL or TLS encryption can be made to the IMAP service.

Transport:

Log Name:      Application
Source:        MSExchangeTransport
Date:          2012/04/23 08:32:27 AM
Event ID:      12014
Task Category: TransportService
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      exch01.domain.local
Description:
Microsoft Exchange could not find a certificate that contains the domain name 
mail.example.com in the personal store on the local computer. Therefore, it 
is unable to support the STARTTLS SMTP verb for the connector Default EXCH01 
with a FQDN parameter of mail.example.com. If the connector's FQDN is not 
specified, the computer's FQDN is used. Verify the connector configuration 
and the installed certificates to make sure that there is a certificate with
a domain name for that FQDN. If this certificate exists, run 
Enable-ExchangeCertificate -Services SMTP to make sure that the Microsoft 
Exchange Transport service has access to the certificate key.

The odd part is that Get-ExchangeCertificate show the cert as enabled for all the relevant services, and OWA is working flawlessly using this certificate.

[PS] C:\Users\graeme\Desktop>Get-ExchangeCertificate

Thumbprint                                Services   Subject
----------                                --------   -------
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX  ....S.     CN=exch01
YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY  ....S.     CN=exch01
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ  IP.WS.     CN=mail.example.com, OU=Domain Control Validated, O=mail.exa...

Here's the certificate in the computer account's personal cert store:

Does anyone have any pointers for getting POP3/IMAP4/SMTP to use the cert again?

6
  • Does the certificate appear in the Certificates MMC snapin? Apr 23, 2012 at 7:50
  • @ChrisMcKeown: yes, added screenshot. Apr 23, 2012 at 9:56
  • Is the SSL cert a wildcard certificate, or specifically for your mail.example.com address? Apr 23, 2012 at 10:11
  • No it's the exact name. It's been set up and working for months, its just suddenly started complaining after this box rebooted in the early hours of the morning. If I haven't found the answer by this evening I'm going to give it a reboot and see if its one of those weird inexplicable things that tend to happen. Apr 23, 2012 at 10:49
  • Remove and re-add the cert?
    – David
    Mar 24, 2014 at 19:45

3 Answers 3

1

Go to Services, and look at the "Log On As" column for these 3 services:

  • Microsoft Exchange IMAP4
  • Microsoft Exchange POP3
  • Microsoft Exchange Transport

By default, they will all use "Network Service".

Then run mmc.exe elevated and add the Certificates snap-in for the local computer. Right-click the relevant certificate (e.g. mail.example.com) and click "Manage Private Keys..." in the pop-up menu. Ensure that the relevant account (e.g. NETWORK SERVICE) has Read permission; it doesn't need Full Control, so that won't affect this issue whether it's ticked or not, but I recommend only giving Read access (principle of least privilege).

Then restart the relevant services for this change to take effect.

0
  1. Run Enable-ExchangeCertificate -Thumbprint -Service POP , do the same for IMAP :) .
  2. Check that you have the certificate enabled on the CA server
5
  • Ran Enable-ExchangeCertificate and restarted the services, made no difference. Assuming the "CA" in #2 refers to the client access server, then yes this is done, it's a single-server setup. Apr 23, 2012 at 9:48
  • Please check if you have the following services running : HTTPFilter ,Security accounts service , and the ports for : POP3 (110), IMAP(143),SMTP(25), SSMTP (465),IMAP SSL(585/993),SECURE pop3 - 995, openned. See for what purposes the certificate is enabled.
    – Alex H
    Apr 23, 2012 at 13:42
  • "Security Accounts Manager" is running. I see no service called HTTPFilter. There is no local firewall that would prevent traffic to/from these ports. The certificate is enabled for POP/IMAP/SMTP/IIS, as per the original question. Apr 24, 2012 at 8:51
  • I am taking a wild guess , but have you seen if you are sending the correct DNS record like exch01.domain.local points to mycompany.blabla.com (you company DNS A entry / MX record ) ? Please see if you don't have other errors in event log that could help you solve the issue .
    – Alex H
    Apr 24, 2012 at 12:49
  • No, the DNS is fine. It's been configured and working 100% for months. The only thing that happened is that the box had a blue screen and rebooted in the middle of the night. Since that happened the only thing that seems to be able to use the cert is OWA. Apr 25, 2012 at 12:06
0

I only verified the access of de Client Access Server to the internet and view in the EMC of Microsoft Exchange if the certificates are updated with no warnings.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .