I am about to renew a SSL certificate to be used with Microsoft Exchange Server 2013. I am viewing the current SSL certificate that is about to expire to check what addresses are currently included on it so that I know what to specify in the new SSL certificate.

Current addresses:

DNS Name=mail.example.com
DNS Name=autodiscover.example.com
DNS Name=exchangeserver.example.local

My question is do I still to include the exchangeserver.example.local address or is this only included for some old historic reason? By my understanding you shouldn't include .local addresses on SSL certificates these days, but how can I check whether not including this will cause any problems when I switch to the new SSL certificate?

Is there any way to check whether anything is currently using the .local address to connect?

  • 2
    If you use a public CA you will probably not succeed with including .local into the certificate. Public CAs will now only sign certificates which include only public accessible names. If you use a private CA you still can sign anything you want. – Steffen Ullrich May 11 '15 at 13:46

If you're renewing this certificate with a public CA, your request will either be rejected, or the SAN entry with the .local DNS name will be stripped.

From the CA/Browser forums Baseline Requirements (

[...] Also as of the Effective Date, the CA SHALL NOT issue a certificate with an Expiry Date later than 1 November 2015 with a subjectAlternativeName extension or Subject commonName field containing a Reserved IP Address or Internal Name. Effective 1 October 2016, CAs SHALL revoke all unexpired Certificates whose subjectAlternativeName extension or Subject commonName field contains a Reserved IP Address or Internal Name.


The certificate used by an Exchange server must include all names with which the server can possibly be called; if your server is configured to use different URLs for internal and external web services, and if the internal URLs use the "corp.local" suffix (which I'm assuming is the DNS name for your Active Directory domain), then yes, your Exchange certificate will need that name too.

If in doubt, just ask Exchange to generate a new certificate request (either via the Exchange Control Panel or via the Exchange Management Shell); it will automatically include all required SANs.

You can check the current configuration of Exchange virtual directories using the following commands:

Get-OwaVirtualDirectory | fl InternalUrl, ExternalUrl
Get-EcpVirtualDirectory | fl InternalUrl, ExternalUrl
Get-OABVirtualDirectory | fl InternalUrl, ExternalUrl
Get-ActiveSyncVirtualDirectory | fl InternalUrl, ExternalUrl
Get-WebServicesVirtualDirectory | fl InternalUrl, ExternalUrl
Get-PowerShellVirtualDirectory | fl InternalUrl, ExternalUrl
Get-OutlookAnywhere | fl InternalHostname, ExternalHostname
  • How can I check whether it is using any .local addresses? – Jack May 11 '15 at 13:26
  • I've added several helpful commands. – Massimo May 11 '15 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.