Unlike Exchange 2003, by default Exchange 2007 is automatically configured with a self-singed certificate and is enabled for SSL upon installation. This certificate is a requirement for Exchange to work properly in most aspects and you’re better off replacing the self generated cert with a cert for a trusted certificate authority. These certificates used to be extremely expensive and these days you can get them dirt cheap in comparison from a CA like Godaddy or Digicert.
With the integration of the Exchange Management Shell, the cert request, installation and activation process is easily accomplished in only a few steps. I should also mention that with the introduction of Exchange 2007 there are new requirements for the certificates used. Subject Alternative Name (SAN) certificates are multi-domain certificates that allow more than one FQDN. 2007 has the need to use multiple domain names in a single cert for internal and external users; as well as, the autodiscover domain name. Having a single cert for all these names streamlines and simplifies the process of installing the certificates.
-
Generating the Certificate Request
- Open the Exchange Management Shell
- Type New-ExchangeCertificate -GenerateRequest -DomainName mail.company.com, autodiscover.company.com, servername, servername.company.local -Friendlyname mail.company.com -PrivateKeyExportable:$true -Path c:\certreq.txt
- After you hit enter the thumbprint of the cert will be generated and displayed.
- Use the generated certreq.txt when prompted at your chosen CA
- Once you’ve acquired your certificate save it to c:\mail.company.com.cer
- Again from the Exchange Management Shell type Import-ExchangeCertificate –Path c:\mail.company.com.cer | Enable-ExchangeCertificate –Services “POP, IMAP, IIS, SMTP”
- After you hit enter your new cert will be enabled for the services listed in the command. To verify the successful installation use this command Get-ExchangeCertificate | FL
This process can be done with a self generated cert as long as that cert has been manually installed and trusted by the clients. To get more information on configuring a self signed cert so your server doesn’t drive you crazy with password prompts view this article.
If you’re getting random password prompts to your users it’s likely your certificate is configured incorrectly or is missing a FQDN that’s needed for the clients to successfully authenticate over SSL.