The server is a HUB and CAS (although we don't really use OWA). The Hub also has Public Folders on it. I'm not sure how to tell which certificates are actually IN use. When I open a Certificate MMC and look at Certificates\Trusted Root [EMAIL PROTECTED] and view it's properties, it tells me the (default) certificate has expired or is not yet valid (September 2008 date).
If I do a get-exchangecertificate, I receive FOUR thumbprints, Two say they expire on 11/3/2009, one says it expires on 9/22/2009, and one says it expires on 9/19/2008. The 9/19/2008 expired date is the one I see on Certificates\Trusted Root [EMAIL PROTECTED], and is the default certificate created when we built the server on 9/19/2007. The 9/22/2009 certificate was probably my first attempt at a renewal, which I'm thinking didn't take. Perhaps I can delete the 9/19/2008 and 9/22/2009 certificates. The 11/3/2009 are probably the ones I created successfully on November 3rd (one of which was the default certificate for SMTP, POP, IMAP..... and the other was one I created for IIS). Is there any easy way to tell what certificates are actually in use and what might be safe to delete? What might have prevented my new certificate from functioning? Thanks! ________________________________ From: Alex Fontana [mailto:[EMAIL PROTECTED] Sent: Monday, November 03, 2008 11:17 PM To: MS-Exchange Admin Issues Subject: Re: Exchange 2007 Self-Signed Certificate If you try to delete the cert being used by the transport service you will get an error. You should be able to remove the others with no issues, esp if HT is the only role on the box. If that is also a CAS you will have to make sure that cert isn't being used by any of the other services. On Mon, Nov 3, 2008 at 6:45 AM, McCready, Rob <[EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>> wrote: I recently had some trouble trying to renew the default Exchange 2007 self-signed certificate on our Hub Transport Server. I think I MAY have finally had some success, but, I want to make sure before I delete the old certificates. My first question is, when you run a get-exchangecertificate command, should you only see ONE thumbprint? I currently see four. When I look at them, three say they expire in 2009 and one says September 2008. I'm wondering if I can get rid of the other three. Also, when I open CERTIFICATES in the MMC and look at Trusted Root Certification Authorities\Certificates, I see the [EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]> still says September 2008. Could this be because Active Directory could take four hours to update? How I can test that the new certificate is actually working before deleting the old ones? Thanks. Rob ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~
