I am getting cert error on our external domain for TLS. I already have a cert for Web Outlook and ActiveSync, but that's a different domain name, this is our mail.name from our MX records that I've never put a cert on. I don't mind buying a public cert for it, but I am confused on the cert setup in EMC to generate the request that would address this specific error. Can you help with what to choose on the Exchange Configuration page of the New Exchange Certificate wizard?

EventID 12014 MSExchangeTransport

Microsoft Exchange could not find a certificate that contains the domain name mail.mydomainhere.com in the personal store on the local computer. Therefore, it is unable to support the STARTTLS SMTP verb for the connector Windows SBS Internet Send SERVERNAME with a FQDN parameter of mail.mydomainhere.com. If the connector's FQDN is not specified, the computer's FQDN is used. Verify the connector configuration and the installed certificates to make sure that there is a certificate with a domain name for that FQDN. If this certificate exists, run Enable-ExchangeCertificate -Services SMTP to make sure that the Microsoft Exchange Transport service has access to the certificate key. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


You can expand any of the sections (doesn't matter) under the "Exchange Configuration" page of the new certificate wizard and just type in mail.mydomainhere.com, and hit next. The wizard is just trying to help make sure you've covered all of your bases, and helps you build a list of names if you're applying for a Unified Communications/SAN certificate.

The "Certificate Domains" page will list all of the names you are putting on the certificate. Since you are only applying for a single name, this should only show the name you entered on the previous page. Again, it doesn't matter which section you put the name under.

Fill out the rest of your organization info and the wizard will generate your CSR.

I generally recommend getting a UC cert that contains all of the names you need or will need for Exchange, so that you can assign one certificate to all services:

mail.domain.com (client access and transport TLS)

You can handle autodiscover for any additional domains by using SRV records that point to autodiscover.domain.com.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.