We recently migrated from Exchange 2003 to 2010. Half of our Outlook users are using Outlook from terminal server which is in the same domain as Exchange. The other half of Outlooks are installed on laptops which are not on domain. They usually use OpenVPN to connect to Exchange (and also to other services) but occasionally, when they are located somewhere where there are most outgoing ports blocked (hotels mostly), they use OutlookAnywhere.

We have 2 certificates: one for 'ourexchangeserver', self-signed, and other for '*.ourexternaldomain.tld', signed by StartCom.

By opening EMC > Server Configuration > Exchange Certificates, we can assign IMAP, POP, SMTP and IIS services to a given certificate.

The problem is that RPC also seems to use this same certificate. So when we assign the wildcard certificate to IIS, we can access OWA externally without any security alerts but Outlooks display a security alert that host name is invalid (does not match the issued to field on the presented certificate).

When we assign the self-signed certificate to IIS, it's the other way around: Outlooks don't complain but browser displays the same security alert when visiting OWA.

My certificate provider (StartCom) does not allow me to generate a certificate issued to a host with missing or nonexistent domain part.

Would it be possible to configure Exchange 2010 with these 2 certificates so that OWA would present the public certificate and RPC traffic would be covered with the self signed certificate?


The usual answers to this problem are:

  • If your internal and external domains match, get a wildcard certificate
  • If they don't match, drop the extra $$ for the "Exchange SSL" certificates on offer at many SSL vendors

The special certificates have multiple Subject Alternate Names on them so they can be valid for a variety of names. Presumably, both your internal and external names for your OWA and RPC services.

| improve this answer | |
  • What about adding an additional IP address to CAS server and moving owa and autodiscover virtual directories on that second ip and associating the public certificate to that ip? – Henno Aug 30 '11 at 6:31
  • 2
    I asked my cert provider to add a Subject Alternative Name "exchange.company.local" to my cert. They declined, saying "since we are a public certification authority we support only host names that are based on registered domain names. For a good reason, because anything else would not provide you with any security at all. The industry already agreed on stopping issuance to non-qualified host names with a sunset date probably in less than three years from today (so far the agreement goes). If you have a minute please read blog.startcom.org/?p=221 " – Henno Sep 9 '11 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.