nm-admin

Installing and managing SSL certificates is one of the important tasks which every Administrator or Network Engineer sooner or later has to deal with.
We have published a series of Screencasts, trying to cover the most popular scenarios which you might normally meet in real life. Here are some of them:

– How to Install a Single Name GoDaddy SSL Certificate in Exchange 2007
– How to Renew (Replace) Self-Signed SSL Certificate in Exchange 2007
– IIS7 – How to Install GoDaddy SSL Certificate
– How to Install Self-signed Certificate – IIS7, Windows Server 2008

– How to Install Self-signed Certificate on a Mobile Device
– How to Add GoDaddy SSL Certificate in SBS 2008
– How to Install a Self Signed Certificate, Using SelfSSL.exe
– How to Export Self-Issued (Exchange 2007) Certificate to a File and Install it on a Mobile Device
– How to Install GoDaddy Multiple Domain (UCC) SSL Certificate in Exchange Server 2007

A lot of companies implement their own CA (Certification Authority) and it becomes an important security point in their organization. We got requests for Screencasts from our subscribers, about Microsoft CA (Certification Authority) installation and usage.
In most cases, you will see in real life the following two Microsoft CA:
– Stand-alone root CA
– Enterprise root CA
They have different operational characterisitcs and we will publish separate Screencasts about the installation and usage for both Microsoft Stand-alone and Enterprise root CA.
In this Screencast, we will demonstrate how to request and install Exchange 2007 Multiple Domain (SAN/UCC) certificate from a Stand-alone Microsoft CA, running on Windows Server 2008.
As usually, we will stick to our Step-by-Step approach and we will start with the installation and fine tuning of Windows Server 2008 Stand-alone CA.
You can download the text file with Exchange Management Shell commands, here.

The Self-Signed certificate in Exchange 2007 (generated automatically during the installation process) is valid for one year. When it expires, Microsoft Outlook 2007 clients on the domain will start getting a pop-up security warning, and constantly confirming it could become quite annoying.

The Self-Signed certificate is not trusted by your clients as the issuer is not in the list of trusted root certification authorities. That causes the pop-up warning in OWA (Outlook Web Access) clients and is one of the problems, when configuring Outlook Anywhere. In Step3 bellow we demonstrate an easy and straight forward way to install the Self-Signed certificate in Windows XP and Windows Vista clients and solve this issue.

Finally, the default Exchange 2007 Self-Signed certificate, generated during the installation, includes only two names – Exchange Server NetBIOS and Exchange internal FQDN (Active Directory Fully Qualified Domain Name). You need to have at least Exchange Server public name and autodiscover name included also in the Certificate, if you want to configure Outlook Anywhere (RPC over HTTP) and avoid the OWA security pop-up warming.

You might find this Screencast helpful, if you are in the following situation:
– The Self-Signed certificate, generated by Exchange 2007 installation has expired and you are getting Event ID: 12014 and 12015 in the Event log, plus the complaints of Outlook 2007 users about the security alert “The security certificate has expired or is not yet valid”.
– You want to enable and configure Outlook Anywhere, without purchasing a commercial multiple domain certificate.
– You want to get rid of the annoying security pop-up warning which OWA (Outlook Web Access) users are getting.

You have the following options:
– Generate a new Self-Signed certificate using Exchange Management Shell and replace the old one – Step2 in this Screencast
– Install and configure Windows CA (Certificate Authority), and request a multiple domain SSL certificate from it – we will demonstrate this scenario, in details in a separate Screencast.
– Purchase and install a commercial SSL certificate – this is already covered in details in our Exchange 2007 Screencast series.

In the following Step-by-Step Screencast, we demonstrate how to generate a new Self-Signed certificate in Exchange Server 2007 which includes all the necessary names in it. You can also see how to enable the SSL certificate for the Exchange services and remove the old one.

For your convenience, we provide the text file with the shell commands, used in the tutorial here.