I'm trying to replace an expired self-signed SSL certificate on my Exchange server. I created a new certificate with selfssl, but when I try to add a new public folder I get an error telling me that "the ssl certificate server name is incorrect."
I suspect the reason for this is that my server's public FQDN and its internal name are not the same (obviously), so when I'm managing the server locally I get this error. To be specific, I get this error when I try to add a new public folder from the server itself (via remote desktop). Clients on my LAN can access OWA on the server just fine (besides my browser warning me that the certificate is self-signed, which is to be expected). On my LAN, my public FQDN properly resolves to the machine's internal LAN IP address.
The previous certificate had a list of 5 or so names (localhost, mail.mydomain.com, mail.mydomain.local, mail, etc.) in the "issuer" field. My question can be solved by providing me with one of two pieces of information:
How do I create a certificate with more than one CN value? The obvious solution of passing more than one to selfssl doesn't seem to work. I'm not going to be convinced to buy a UC certificate because "well, Exchange requires this weird thing, just buy it and everything will be okay." It must be possible to sign a certificate that will work for this using OpenSSL or etc.
It seems very odd to me that I should need a certificate with anything other than my FQDN. Is there some way to make Exchange behave in a sane way, without needing a certificate with SAN? This is by far my preferred solution.
This server is running Small Business Server 2003, and Exchange Server 2003 SP2.