1

I saw that I can add many certificates in Exchange 2013. I cannot understand how it chooses its certificate because I can set many certificate for the same service (for example SMTP).

Let's say that I have a public SSL wildcard for myexternaldomain.com but Exchange replies from external but also from internal name like myinternaldomani.com, how it works? May I use an autosigned for internal and public wildcard for external?

EDIT Now I'm in this scenario: I have a local domain (myinternaldomani.local) and a public domain (myexternaldomain.com). All my outlook clients use username@mydomain.local to connect to Exchange thorught IIS, outer users and owa webmail use username@myexternaldomain.com. I loaded the wildarcard certificate for myexternaldomain.com for IIS service, now external users (Outlook or OWA) trust the connection but all internal outlooks fail to verify the certificate host name.

Improve this question

1 Answer 1

Reset to default
3

You cannot have multiple certificates for all services. However for Receive Connectors it uses a match on the FQDN. Therefore if you set the FQDN to mail.example.com then you need to have an SSL certificate that matches.

The self signed auto generated certificate is fine for SMTP traffic, whether internal or external, unless you have a very picky external sender. Then I would configure a specific connector. For internal traffic, I would use the same host name as you do externally. With Exchange 2013 there is no need for any user or service to know the real name of the server, as split DNS is pretty much mandatory with the way that Exchange needs to handle SSL certificates.

Don't try and complicate it by mix and match - use the same certificate where possible for everything.

Improve this answer
4
  • Thank you for your reply, I have some trouble with IIS service because it should use different certs for inner or outer connections, please see my edit in the question.
    – Tobia
    Oct 4, 2017 at 6:37
  • The response I provided you still stands. You need to decide what names you are using for Exchange access and use them throughout - the same name both internally and externally. As you cannot have .local on a trusted certificate then you need to tell users to use the external name and configure your DNS so the external name resolves internally to the internal IP address.
    – Sembee
    Oct 4, 2017 at 10:27
  • Do you mean that ExternalHostname and InternalHostname should match in OutlookAnywhare config? Trying a solution I'm getting out of topic, I opened a new question: serverfault.com/questions/876811
    – Tobia
    Oct 4, 2017 at 11:00
  • Whatever you are using externally, should be used internally. Simple as that.
    – Sembee
    Oct 4, 2017 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.