Outlook Security Alert following Exchange 2007 upgrade to SP2

Question

Following an update to Exchange 2007 sp2 (yes I know very belated) I have an issues when logging onto Outlook. I see the below message...

alt text http://www.freeimagehosting.net/uploads/1960a40166.jpg

I also had a simlar issues with web access and as I am at home with IIS, this was easily solved. However I did notice that the server contains a number of keys for autodiscover.mycompamy.com, exchange.mycompamy.com etc and it seems that the SP2 upgraded didnt know how to deal with this.

As I have a wildcard ssl, I think it would be prudent to remove all other certificates, however in order to stop the nag when opening outlook - what can I do?

Answer 1

From EMS run get-exchangecertificate This will show you all of your certs and where they are being used. Under services, I is for IIS and should be applied to your wildcard certificate. If it is not, copy the thumbprint for your wildcard cert and run this command:

enable-exchangecertificate -thumbprint <paste thumbprint here> -services IIS

Then try out the connection again.

Answer 2

This looks more like a misconfiguration on IIS/Exchange than an actual problem caused by SP2; maybe it just resetted some settings to default value, causing this behaviour.

Your screenshot shows that the autodiscover service was called using the host name "autodiscover.ad.unc.edu"; if you click on the "View Certificate" button there, you can look at which certificate was actually used, and see if it matches the called URL.

Also, "autodiscover.ad.unc.edu" looks like an internal domain to me (a subdomain of your main domain, specifically for AD usage); if this is the name you should actually use (is it?), then your wildcard certificate may not be enough for this, as many browsers are known to not handle correctly wildcard certificates for second-level subdomains (*.*.domain.com).

Answer 3

Obviously the domain in your address bar did not match the common name or the Subject Alternative Name (SAN) field of the certificate on the site.

For instance http://www.ssltools.com/certificate_lookup/autodiscover.ad.unc.edu shows

Common Name : outlook.unc.edu

Subject Alternative Names : outlook.unc.edu, autodiscover.ad.unc.edu, ad.unc.edu, outlook.ad.unc.edu, manning.outlook.unc.edu, franklin.outlook.unc.edu

Issuer Name : DigiCert High Assurance CA-3

Serial Number : 09:85:58:8e:02:1e:74:05:88:7b:11:cc:3e:0a:f6:0c

SHA1 Thumbprint : F3:D6:8E:EC:2D:C7:0D:B1:DD:C8:EA:67:69:9B:C0:A9:03:62:73:FB

Key Length : 2048 bit

Signature Algorithm : sha1WithRSAEncryption

Secure Renegotiation: Not Supported

It displays that your certificate is UCC and will display correctly if I type autodiscover.ad.unc.edu in my browser address windows. Obviously because there is more than 1 level of subdomains on some of your SAN entries, wildcard will not work.