I've generated free certificate at StartCom for external OWA usage remote.domain.com. Problem is after installing it in Exchange, local users started getting errors from Outlook that Exchange.domain.local doesn't match the certificate name. Is there a way to use 2 different certificates. One for local usage thru Outlook MAPI and one for external usage thru OWA? It seemed to work fine with Exchange 2003 without a problem.


NETBIOS name of Exchange : ExchangeServerName
Internal FQDN (AD name) : exchangeserver.local
External FQDN (Public name) : remote.domain.com
Autodiscover name : autodiscover.remote.domain.com
SubjectName : cn=smtp.remote.domain.com

You should have the above on a Self Signed Certificate to work properly and you won't have that warning. Internal FQDN Name should be there.

In Exchange 2010, there is a certificate wizard via EMC (Exch. Mgmt. Console)
I would recommend to follow the tutorial on the link below (good one) :

Hope that Helps

  • Well problem is the self signed certificate works fine alone. Just when i generate new certificate request and validate it on outside and then assign the new certificate it stops working (well it still works just claims the the certificate is ok, just doesn't match the name). The remote access works fine with new certificate thou. – MadBoy Dec 10 '10 at 11:43
  • follow the link - as when you generated the certificate you forgot to mention the internal exchange fqdn - hence it's prompting you. once you have followed the link tutorial and generated one accordingly, enable it and the error should go away. – rihatum Dec 10 '10 at 11:44
  • Well I did follow similar link and all the settings were correct, i even did it once again using other domain name (since i can't revoke cert for free) and the problem was the same. I was using exchange.domain.local for Local access and remote.domain.com for Internet, for autodiscover i had autodiscover.domain.local i think – MadBoy Dec 10 '10 at 12:15
  • Seems like i will need SAN Certificate to cover all domains (internal + external) and your answer touches Self Signed certificate. digicert.com/unified-communications-ssl-tls.htm – MadBoy Dec 10 '10 at 12:25
  • Correct - even if you are using self signed or trusted authority cert, you would need a SAN certificate (Subject Alternative Names) so your domain listed in all its possibilities used on your internal / external network. I thought you were intending to use a self signed one - hence the link or you could use digicert and generate a san cert request. – rihatum Dec 10 '10 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.