Exchange Server SSL Certificate Authority Change

An industry wide change is coming to SSL certificates, which will affect Exchange Server and anything else using intranet names. On October 1, 2016 Certificate Authorities must mandatorily revoke all unexpired certificates with subject alternative names corresponding to internal names. The recommended way of securing Exchange Server with an SSL certificate is coming to an end. In the past, a UCC (SAN) certificate was purchased with a common name pointing to the public DNS address, and subject alternative names pointing to internal fully qualified domain names (usually with a suffix ending in .local or .int) to secure internal users. The good news is you still have until October 31, 2013 to be issued a 2 year certificate with internal subject alternative names. Now that it's 2016, good luck everyone!

Using Intranet and Reserved IP Addresses as the Primary Domain or Subject Alternative Name in SSLs

Date Submitted: 6-26-2012

The Internet security community is phasing out the use of intranet and reserved IP addresses as the Primary Domain Name or the Subject Alternative Name in SSL certificates.

This is an industry-wide decision, not one specific to our company.

An intranet name is any name that is not in the public Internet DNS (e.g.'server1', 'mail', 'www', 'server2.local', etc.). A reserved IP address is any address designated by the Internet Assigned Numbers Authority (IANA) as being reserved.

To create a safer online environment, members of the Certificate Authorities Browser Forum (CA/Browser Forum) worked to define the guidelines and means of implementation of SSL Certificates. As a result of these meetings, effective on October 1, 2016, Certification Authorities (CAs) must revoke any SSL certificates that use intranet names or reserved IP Addresses.

As a result of this decision, on July 1, 2012, we no longer accept new requests, process rekeys or renewals, or allow any management of Subject Alternative Names for certificates that contain intranet names or reserved IP addresses, and are valid beyond November 1, 2015. If you have an existing certificate that contains an intranet name and/or a reserved IP address, you can continue to use that certificate until it expires or until October 1, 2016, whichever comes first.

To read CA/Browser Forum guidelines, go here.

For more information on which IPv4 addresses are reserved, go here. Some addresses are mentioned only in the footnotes. We do not support any certificates using IPv6.

If you are too lazy like me to read through the entire Baseline Requirements document, here are the manuals to modify Exchange Server 2007 / 2010

Exchange 2007

  1. Start the Exchange Management Shell.
  2. Modify the Autodiscover URL in the Service Connection Point. The Service Connection Point is stored in the Active Directory directory service. To modify this URL, type the following command and then press ENTER:
    Set-ClientAccessServer -Identity CAS_Server_Name -AutodiscoverServiceInternalUri https://mail.contoso.com/autodiscover/autodiscover.xml
  3. Modify the InternalUrl attribute of the EWS. To do this, type the following command, and then press ENTER:
    Set-WebServicesVirtualDirectory -Identity "CAS_Server_Name\EWS (Default Web Site)" -InternalUrl https://mail.contoso.com/ews/exchange.asmx
  4. Modify the InternalUrl attribute for Web-based Offline Address Book distribution. To do this, type the following command, and then press ENTER:
    Set-OABVirtualDirectory -Identity "CAS_Server_name\oab (Default Web Site)" -InternalUrl https://mail.contoso.com/oab
  5. Modify the InternalUrl attribute of the UM Web service. To do this, type the following command, and then press ENTER:
    Set-UMVirtualDirectory -Identity "CAS_Server_Nameunifiedmessaging (Default Web Site)" -InternalUrl https://mail.contoso.com/unifiedmessaging/service.asmx

    Note This command is required only in an Exchange 2007 environment. This command no longer exists in an Exchange 2010 environment. Instead, the WebServices URL is used for this purpose.

  6. Open IIS Manager.
  7. Expand the local computer, and then expand Application Pools.
  8. Right-click MSExchangeAutodiscoverAppPool, and then click Recycle.

Exchange 2010

  1. Start the Exchange Management Shell.
  2. Modify the Autodiscover URL in the Service Connection Point. The Service Connection Point is stored in the Active Directory directory service. To modify this URL, type the following command and then press ENTER:
    Set-ClientAccessServer -Identity CAS_Server_Name -AutodiscoverServiceInternalUri https://mail.contoso.com/autodiscover/autodiscover.xml
  3. Modify the InternalUrl attribute of the EWS. To do this, type the following command, and then press ENTER:
    Set-WebServicesVirtualDirectory -Identity "CAS_Server_Name\EWS (Default Web Site)" -InternalUrl https://mail.contoso.com/ews/exchange.asmx
  4. Modify the InternalUrl attribute for Web-based Offline Address Book distribution. To do this, type the following command, and then press ENTER:
    Set-OABVirtualDirectory -Identity "CAS_Server_name\oab (Default Web Site)" -InternalUrl https://mail.contoso.com/oab
  5. Open IIS Manager.
  6. Expand the local computer, and then expand Application Pools.
  7. Right-click MSExchangeAutodiscoverAppPool, and then click Recycle.

Click here to see the documentation of Microsoft.

Share
Disqus Comments Loading...

Recent Posts

VMWare vSphere 6.7 ESXTOP Output Garbled

If your VMWare vSphere 6.x environment command output of esxtop looks like a bunch of garbled gibberish (it's actually CSV… Read More

February 28, 2019 7:39 pm 19:39

How To Run RoboCopy Backup in Parallel

From time to time Windows Admins will surprise you with band-aid and bubble gum scripts, that's entirely expected I think.… Read More

February 28, 2019 12:20 pm 12:20

Windows 10 GodMode - The Ultimate Administrator Shortcut

Have you ever wondered what life might be like if the Windows 10 OS somehow had a single folder that… Read More

February 28, 2019 7:58 am 07:58

Samsung Galaxy S9 G960/G965 Stock ROM Firmware Download

There could be any number of reasons for needing to flash manufacturer stock OEM firmware on a Samsung Galaxy S9… Read More

January 24, 2019 7:42 am 07:42

Output IP Address with ipconfig Findstr Ethernet Adapter

How many times have you entered  ipconfig /all at the command line to return a single IP address, then have to strain… Read More

January 20, 2019 12:39 am 00:39

AWS SES Assistance in Enterprise Market - A Must Read

Designing e-mail solutions on a large scale can be a complex and costly challenge for a business: you need to… Read More

December 25, 2018 4:01 pm 16:01