I'm trying to replace an expired self-signed SSL certificate on my Exchange server. I created a new certificate with selfssl, but when I try to add a new public folder I get an error telling me that "the ssl certificate server name is incorrect."

I suspect the reason for this is that my server's public FQDN and its internal name are not the same (obviously), so when I'm managing the server locally I get this error. To be specific, I get this error when I try to add a new public folder from the server itself (via remote desktop). Clients on my LAN can access OWA on the server just fine (besides my browser warning me that the certificate is self-signed, which is to be expected). On my LAN, my public FQDN properly resolves to the machine's internal LAN IP address.

The previous certificate had a list of 5 or so names (localhost, mail.mydomain.com, mail.mydomain.local, mail, etc.) in the "issuer" field. My question can be solved by providing me with one of two pieces of information:

  1. How do I create a certificate with more than one CN value? The obvious solution of passing more than one to selfssl doesn't seem to work. I'm not going to be convinced to buy a UC certificate because "well, Exchange requires this weird thing, just buy it and everything will be okay." It must be possible to sign a certificate that will work for this using OpenSSL or etc.

  2. It seems very odd to me that I should need a certificate with anything other than my FQDN. Is there some way to make Exchange behave in a sane way, without needing a certificate with SAN? This is by far my preferred solution.

This server is running Small Business Server 2003, and Exchange Server 2003 SP2.

  • 2
    What version of Exchange? Later versions include Powershell commands to generate the correct cert. – Zoredache Jun 27 '13 at 18:08
  • I've updated my OP to include the particular version of Windows & Exchange I'm working on. – CmdrMoozy Jun 27 '13 at 19:20

If you want a certificate with more than one name, you need to purchase a certificate that supports Subject Alternate Names. I've bought one today for little over £55. It's not one of the strongest certs you can buy, but for a small business with only internal staff using the system, they're fine, and will quash all certificate errors.

If you host external DNS with an ISP, and (obviously) host your internal DNS within your network, then it's very easy to get round this and you don't need a cert with SANs. Note this doesn't apply to versions of Exchange after 2003, so purchasing a cert is your only option.

For example, if your exchange server externally is exchange.example.com but you use some other internal name (e.g. exchange.example.local or exchange.internal.example.com), then all you need to do is create a new DNS forward lookup zone for exchange.example.com on your internal DNS, and add a default '@' record, to the zone, which points to your exchange server.

Internal lookups for exchange.example.com will resolve to your internal IP, whilst queries performed outside your network will resolve to your external IP address.

  • I have a forward lookup zone for my public FQDN, and it has an A record for the machine's internal IP address. The certificate error only seems to appear when I'm trying to create new public folders on the machine itself. Clients on the LAN can access OWA just fine - it warns that the certificate is self-signed, but not that the domain is wrong. Also, why would generating my own cert with SAN extensions not work, as per e.g. langui.sh/2009/02/28/openssl-sanucc-certificate-generation? – CmdrMoozy Jun 27 '13 at 19:41
  • Ah, that wasn't clear in the question until you've just edited it. I wasn't aware you could create your own self signed SAN certs, having said that, I've never ventured beyond the Windows CA for self signed certs. – Bryan Jun 27 '13 at 19:44
  • So since my certificate has a CN of "mail.mydomain.com", and on my LAN "mail.mydomain.local" resolves to the internal IP of the server, what else is necessary for me to be able to create public folders? – CmdrMoozy Jun 28 '13 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.