Hardware/software info

Server 2008 R2 64 bit


Exchange 2010

Issues and steps taken:

I have imported my Godaddy wildcard cert, and all intermediate certs related to the wildcard cert, into the server.

I have changed the Exchange IIS 7 sites to use mail.domain.com and servername.domain.com appropriately. (This includes adding the correct names.)

Going to hxxps://mail.domain.com - everything works perfectly. Going to (internal) servername.domain.c0m gets me to the log in page with the wildcard cert and no warnings. When I log in, I get a broken page. It’s as if I was offline.

Trying to use my droid to connect and get email gives me the following error "Network not available:

I changed all of these without changing the cert for Exchange and got the above results. (I was making just one change at a time for easier diagnosis if something goes wrong.)

In Exchange 2010 the old cert has the following services on it: IMAP, POP, IIS, SMTP I tried to assign the same services to the new wildcard cert, but it would not take all of the services away from the old cert. Do I need to delete the old cert before I can assign the new cert these services?

I have put everything back to the old cert and all is well again. I have to get this changed over fairly soon, as time is running out on the old cert.

  • 4
    Please refrain from asking us to give you "complete steps" because of your inability to do your own work. We're not being paid for helping out. – pauska Mar 12 '12 at 14:42

Wildcard certificates are known to cause problems with many different devices and operating systems. I strongly suggest that you switch over to a UCC-certificate from a known vendor.

  • +1. I had exactly the same problem with the same setup. I got my $ back from GoDaddy and bought one from a well-known and expensive vendor and it works perfectly. The problem was that the mobile devices we're using did not trust the root CA used to sign the GoDaddy cert. – Paul Ackerman Mar 12 '12 at 18:13

Microsoft recommends to use SAN certificates with Exchange 2010 instead of wildcard certificates: http://technet.microsoft.com/en-us/library/dd351044.aspx#digitalcertificatesbestpractices

  • Agreed, a SAN cert is the way to go. – Tatas Mar 12 '12 at 16:35
  • We bought the wildcard cert to avoid lots of different certs. I hate to go back if I do not have too...Others have it working using a wildcard cert, and I had all but the internal OWA site working. Any other thoughts on this? - Thanks. – OneGuy Mar 12 '12 at 19:09

I had the same exact Issue and this is how I fixed it.

  1. I restarted all the exchange services [Didn't help]

  2. I followed this instruction http://exchangeserverpro.com/exchange-server-2010-certificate-invalid-for-exchange-server-usage-error/ [Didn't work but helped me get there]

  3. Follow the step 2 for the mmc console and browse to Certificates(local Computer)> Trused Root Certification Authorities > Certificates > "This is where you will have to find your intermideate cert that came with your *wild card cert" after you locate the cert right click and property and allow for all purpose or allow all

Go back to your EMC > Microsoft exchange >Server Configuration to verify


Most customers that I have seen that work with Exchange go with the UCC. Wildcards, although feasible (certain things have to align like the domain must be the same and only differ by subdomain), cause many problems and the cost difference for many is just not worth it. In addition, there are UCC certs now that are cheaper than wildcards, albeit they may limit the number of domains (and by extension subdomains). Many choices out there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.