Buy from the highest-rated provider   Buy SSL.com Certificate x

How to use SSL Certificates with Exchange 2007


The new version Microsoft Exchange, Exchange Server 2007, adds a wealth of new features and makes many things easier to do. Unfortunately, installing SSL Certificates isn't really one of them. Installing an SSL Certificate in Exchange 2007 requires you to run several commands in the Exchange Management Shell. Don't fret yet! If you carefully following these instructions, you'll have your Exchange 2007 server secured in no time!

Determine Your Needs

Copying and Pasting in the Exchange Management Shell

Unfortunately, you can't just use Ctrl+C and Ctrl+V to copy and paste in the Exchange Management Console. To copy something (like a thumbprint), right-click the shell window and Click Mark. You can then highlight the text that you want to copy and press Enter to copy it. To paste, just right-click and select Paste.

There are several methods of securing your Exchange 2007 server. This article will walk you through the process of ordering a Unified Communications SSL Certificate with multiple domains from a commericial certificate authority and installing it on your Exchange server. Exchange 2007 includes some new features, like Autodiscover, that require multiple names to be secured. There are other methods of securing the additional Exchange 2007 names but the recommended method is to use a Unified Communications Certificate so you only have to worry about one certificate and one IP address.

What names do you need to include? It depends on what services and features you plan to use. At a minimun, you need to include the external name that people use to send and receive mail (mail.yourdomain.com) and the base domain and local name (yourdomain.com and yourdomain.local). You will also want to include the name for Autodiscover (autodiscover.yourdomain.com) so that Outlook 2007 users can use the Autodiscover feature without receiving errors. If you would like to use OWA internally, you will also want to include two NetBIOS names (Server01.yourdomain.local and Server01). So, in a typical scenario, you would include the following names in your UC Certificate:

  • mail.google.com
  • autodiscover.google.com
  • google.com
  • google.local
  • Server01.google.local
  • Server01

For more information about which names to include see the resources in the Links section below. Once you have determined which names you need to secure you are ready to create a Certificate Signing Request and order the certificate.

Can I use a Wildcard certificate?

A Wildcard certificate (*.yourdomain.com) will secure all first-level subdomains of a particular domain. This could work to secure your Exchange 2007 server, but it is not reccomened for these reasons:

  • You wouldn't be able to access the server using the internal server name (Server01) because it is not covered by the certificate and you would receive a "name mismatch" error.
  • A wildcard certificate is incompatible with POP3 and IMAP4 on Exchange 2007. See Microsoft's explanation of what certificates to use with Exchange 2007 for more information.

Create the Certificate Signing Request

Before you can order an SSL certificate for Exchange 2007, you need to create a Certificate Signing Request using the instructions below:

  1. Click on the Start menu, go to All Programs, then Microsoft Exchange Server 2007 and click on Exchange Management Shell.

    Open the Exchange Management Console

  2. Run the New-ExchangeCertificate command below replacing the appropriate values with your own. We recommend using DigiCert's New-ExchangeCertificate Command Generator to get a command that you can just paste in.

    New-ExchangeCertificate -domainname mail.google.com, google.com, google.local, autodiscover.google.com, server01.google.com, server01 -Friendlyname google.com -generaterequest:$true -keysize 2048 -path c:\certrequest.txt -privatekeyexportable:$true -subjectname "c=US, o=Google Inc., cn=server01.google.com, s=California, l=Mountain View, ou=IT"

    NameExplanationExamples
    -domainname Enter all of the names that you determined you needed to secure in the step above.

    mail.google.com
    autodiscover.google.com
    google.com
    google.local
    Server01.google.local
    Server01
    -Friendlyname Any name you want to use to keep track of the certificate on this server. my google certificate
    -keysize The size of the key that is generated. Bigger numbers are more secure but can be slower. 2048 is recommended 2048
    -path The location where you want to save the CSR. c:\certrequest.txt
    Common Name (cn=) Enter the first name in your list above. This is the most visible name in the certificate (the other names are listed as Subject Alternative Names and they aren't displayed as clearly)

    mail.yourdomain.com
    Organization (o=) The legal name of your organization. This should not be abbreviated and should include suffixes such as Inc, Corp, or LLC. Do not include commas or the command won't work. Google Inc.
    Organizational Unit (ou=) The division of your organization handling the certificate. Information Technology
    Web
    City/Locality (l=) The city where your organization is located. Mountain View
    State/province (s=) The state/region where your organization is located. This shouldn't be abbreviated. California
    Country/Region (c=) The two-letter ISO code for the country where your organization is location. US
    GB

    Run the New-ExchangeCertificate command

Once you have generated a CSR you can use it to order the certificate from a certificate authority. Not all providers offer Unified Communications Certificates, but you can pick one from our list of Unified Communications SSL Certificates or you can compare SSL UC certificates using the SSL Wizard to find one. Once you find the provider that you want to buy from, click the Buy Now button and go through the order process. You will paste in the CSR and provide information about your company so it can be validated. Once the SSL provider validates your order, you will receive your new UC certificate file.

Install the Certificate

To install your newly acquired SSL certificate in Exchange 2007, first copy the certificate file somewhere on the server and then follow these instructions:

  1. Click on the Start menu, go to All Programs, then Microsoft Exchange Server 2007 and click on Exchange Management Shell.
  2. Run the Import-ExchangeCertificatecommand below. Make sure to specify the path to the certificate file you downloaded and remove any services that you will not be using.

    Import-ExchangeCertificate -path c:\google.p7b | Enable-ExchangeCertificate -Services IMAP, POP, UM, IIS, SMTP

  3. If you didn't receive any errors, then it should have installed correctly. Run the Get-ExchangeCertificatecommand to verify that the certificate is enabled for the correct services. If you aren't sure which thumprint it is, you can view the thumbprint of the certificate you just installed by double-clicking it and looking for the thumbprint on the details tab.

  4. If the certificate isn't enabled for the correct services (S=SMTP, I=IMAP, P=POP, U=Unified Messaging, W=Web/IIS) you need to run the Enable-ExchangeCertificatecommand below. You can copy the thumbprint from the output of the Get-ExchangeCertificate command that you just ran.

    Enable-ExchangeCertificate -Services IMAP, POP, UM, IIS, SMTP -thumbprint 896B74B25F7EBF330C93E56DA2A76CFC6A7

  5. After running the Enable-ExchangeCertificate command, run the Get-ExchangeCertificate command again to verify that the certificate is enabled for the correct services.

Install any Intermediate Certificates

This step is not necessary if you received a .p7b certificate file from your SSL provider because this file contains all the Intermediate certificates and they are automatically installed. If you received an individual .crt certificate file you may need to follow the instructions in this step.

Most SSL providers issue server certificates off of an Intermediate certificate so you will need to install this Intermediate certificate to the server as well or your visitors will receive a Certificate Not Trusted Error. You can install each Intermediate certificate (sometimes there is more than one) using these instructions:

  1. Download the intermediate certificate to a folder on the server.
  2. Double click the certificate to open the certificate details.
  3. At the bottom of the General tab, click the Install Certificate button to start the certificate import wizard. Click Next.

  4. Select Place all certificates in the following store and click Browse.

  5. Check the Show physical stores checkbox, then expand the Intermediate Certification Authorities folder, select the Local Computer folder beneath it. Click OK. Click Next, then Finishto finish installing the intermediate certificate.

You can verify that the certificate is installed correctly by visiting the site in your web browser using https instead of http or using our SSL Checker.

Links

Exchange 2007 SSL Certificate Videos

Originally posted on Tue Jul 3, 2007

Comments


paul(2014-12-13)

article was a huge help.

Michael O'Quin(2014-12-13)

Thanks a lot for your post.

Daniel(2014-12-13)

spot on article, saved my bacon a bunch of times.

Sketchy(2014-12-13)

When purchasing an SSL, most providers will have a selection for "Server Software" On a system that I want the certificate to handle internal OWA requests, as well as Exchange, which option should I choose on the list; IIS, or Exchange?

Ray(2014-12-13)

Thanks for this great article. Been struggeling for a while with this, but this step by step really helpded! THANKS!

Robert(2014-12-13)

You can select IIS or Exchange as the server software when ordering the certificate. It should work with either one. "Exchange" is probably better because it is more specific.

Sarvesh Huddedar(2014-12-13)

nice work. In case if someone wants to test ssl certificates and related functionality of exchange services published publicly or findout where are the problem and why services are not working as per the expectations, visit

www.testexchangeconnectivit...

this website is trusted and will help analyze where exchange configuration which is configured is correct or need some changes as well.
In case of any errors, this website will help you find best practices as well.

Regards,
--
S a r v e s h

Anne(2014-12-13)

Saved me all kinds of trouble.

Billy Pumphrey(2014-12-13)

This is great. Also Digicert is awesome at their wizard and tutorials.

Thank you lots.

Jose(2014-12-13)

great step by step article!

installed cert ok, but had questions on which cert it was using. Thought intermediate cert. was missing, but was actually wrong cert. that was turned on for services.

Enable-exchangecertificate -services -thumbprint was the answer.

thanks!!!

Robert(2014-12-13)

Hi Ivan,

You can just enabled SMTP without having to regenerate a certificate.

ivan(2014-12-13)

If I've created a CSR using the MMC console and already have the cert in the Exchange store, just without the SMTP service enabled. Will it work if I simply enable the SMTP service, or do I need to start from scratch and re-generate the CSR and get new certificate?
Thank you!
Ivan

Alex(2014-12-13)

I always have to come back to this article ever time I setup a new exchange. Good job

Save

Advertisement • Hide