SSL security and Microsoft Exchange

This year the SSL Certificate Authorities announced that they would no longer be allowing SSL certificates to be issued for private IP and internal domain names. In my company this meant that when our SSL certificate recently expired we could no longer renew it for the internal exchange server name (exchange.domain.local). This was all well and good for OWA and our external staff who used our external domain address in their email clients, but it caused Outlook to have a major hissy fit and complain that the SSL certificate wasn’t valid and kept popping up an annoying warning message.

So off I went to hunt down a solution to the problem. There were two main suggestions that permeated throughout the internet:

1. Map the internal server name to the matching external name by setting up new DNS zones on the domain controller.
2. Changing the Exchange server to user external DNS names.

Option number 1 didn’t work properly for me. It was probably a configuration fault on my part as others have reported success with that approach. However, it is kind of cumbersome as you have to create a new DNS zone for each external address (you’ll need at least two – server.domain.com and autodiscover.domain.com).

Option 2 however was far more successful. Using a guide provided online by Digicert I discovered that using the Exchange Management Shell on the server, there are three Exchange entries that you need to change with the following commands:

• Set-ClientAccessServer -Identity HostName -AutodiscoverServiceInternalUri https://mail.yourdomain.com/autodiscover/autodiscover.xml
• Set-WebServicesVirtualDirectory -Identity "HostName\EWS (Default Web Site)" -InternalUrl https://mail.yourdomain.com/ews/exchange.asmx
• Set-OABVirtualDirectory -Identity "HostName\oab (Default Web Site)" -InternalUrl https://mail.yourdomain.com/oab

Once you have run these commands in Exchange Management Shell on the server, you need to then open IIS Manager, expand Application Pools, right click on MSExchangeAutodiscoverAppPool and then choose the Recycle option.

Once you’ve done this Outlook will no longer complain about invalid SSL certificates.