On my Exchange server, I have two CAS servers in a CAS NLB array. I need to install a 3rd party SAN/UCC certificate on both of these servers for OWA. I generated the request on CAS1, submitted to a public CA and installed it on the CAS1 server. I didn’t generate a CSR on the CAS2 server. I exported the certificate out of CAS1 (with the private key) went to the CAS2 server and imported it into CAS2. The certificate shows as installed on CAS2. Problem is that EMC reports “The certificate is invalid for Exchange server usage” and it shows a red “X” next to the certificate in the EMC.

I’ve tried using both the certificates MMC and EMC to export it from CAS1 and using both to import it into the CAS2 server but no luck. I’ve tried removing the certificate using both EMC and the certificates MMC but when I import it back in I still get the same results. I’ve even restored the complete server from backup to a previous state before I started the certificate import process but I got the same results. Because I’ve gotten the same results after a restore, I’m concerned that something else is wrong here. I can double-click on the certificate in the EMC and in the certificate MMC and both report that the certificate as valid so the trusted root is working.

I wanted to rebuild the local server certificate store but I would think that a complete restore of a server would return the local server certificate store to the previous state. Is there any certificate metadata maintained in AD for a computer object or more specifically for Exchange server objects? Is there anywhere that I can look to figure out why Exchange 2010 SP3 UR2 is reporting that a certificate is valid on one CAS NLB array node but not valid on an identical node?


With many cert providers, you must import the intermediate cert into the appropriate folder in the Certificates console. Did you do that on CAS2?

  • Thanks for the follow up. Yes, I looked into that previously but it didn't resolve the issue. I never figured out what the problem was, A lot changed since then, I ended up having to remove 2010 and installing 2010 hybrid (so we could migrate to Exchange Online) - you have to reinstall to use the hybrid license keys. Still have the hybrid installed, and it works fine. Same cluster name, same computer objects in AD, etc. I didn't remove Exchange but removed one server at a time (so the Exchange attributes remained the same in AD). Not sure what worked... – STGdb Aug 4 '14 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.