I think I'm getting closer. I've created a new certificate on our Hub Transport Server 1 and enabled it. I still show two certificates though.
The default certificate created a year ago which is now expired. The new certificate I just created. If I do a get-transportserver <Hub Server 1> | fl I do see the InternalITransportCertiifcateThumbprint is using the newer certificate. However, if I open the Certificate MMC and look at Trusted Root Certification Authorities\Certificates, I still see [EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]> as using the original (now expired) certificate. Do I need to manually remove the original certificate before Exchange can see the new one? ________________________________ From: Alex Fontana [mailto:[EMAIL PROTECTED] Sent: Tuesday, November 04, 2008 2:58 PM To: MS-Exchange Admin Issues Subject: Re: Exchange 2007 Self-Signed Certificate AFAIK, you can create certificates all day and they'll show up, but they won't all be used. I would check in the IIS config for the cert it is using for OWA, activesync, etc to see which it is. You can view which cert your HT is using by running 'get-transportserver <server> |fl InternalTransportCertificateThumbprint' I've never had issues creating and removing certs from HT/CAS combo's for use with IIS and the transport service. Again, the only thing that's bit me in the past was that when you do create a new cert the 'require secure channel' check box checks itself on the Exchange Vdirs, if you don't use that you'll need to go back and uncheck it. -alex On Tue, Nov 4, 2008 at 6:40 AM, McCready, Rob <[EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>> wrote: The server is a HUB and CAS (although we don't really use OWA). The Hub also has Public Folders on it. I'm not sure how to tell which certificates are actually IN use. When I open a Certificate MMC and look at Certificates\Trusted Root [EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]> and view it's properties, it tells me the (default) certificate has expired or is not yet valid (September 2008 date). If I do a get-exchangecertificate, I receive FOUR thumbprints, Two say they expire on 11/3/2009, one says it expires on 9/22/2009, and one says it expires on 9/19/2008. The 9/19/2008 expired date is the one I see on Certificates\Trusted Root [EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>, and is the default certificate created when we built the server on 9/19/2007. The 9/22/2009 certificate was probably my first attempt at a renewal, which I'm thinking didn't take. Perhaps I can delete the 9/19/2008 and 9/22/2009 certificates. The 11/3/2009 are probably the ones I created successfully on November 3rd (one of which was the default certificate for SMTP, POP, IMAP..... and the other was one I created for IIS). Is there any easy way to tell what certificates are actually in use and what might be safe to delete? What might have prevented my new certificate from functioning? Thanks! ________________________________ From: Alex Fontana [mailto:[EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>] Sent: Monday, November 03, 2008 11:17 PM To: MS-Exchange Admin Issues Subject: Re: Exchange 2007 Self-Signed Certificate If you try to delete the cert being used by the transport service you will get an error. You should be able to remove the others with no issues, esp if HT is the only role on the box. If that is also a CAS you will have to make sure that cert isn't being used by any of the other services. On Mon, Nov 3, 2008 at 6:45 AM, McCready, Rob <[EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>> wrote: I recently had some trouble trying to renew the default Exchange 2007 self-signed certificate on our Hub Transport Server. I think I MAY have finally had some success, but, I want to make sure before I delete the old certificates. My first question is, when you run a get-exchangecertificate command, should you only see ONE thumbprint? I currently see four. When I look at them, three say they expire in 2009 and one says September 2008. I'm wondering if I can get rid of the other three. Also, when I open CERTIFICATES in the MMC and look at Trusted Root Certification Authorities\Certificates, I see the [EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]> still says September 2008. Could this be because Active Directory could take four hours to update? How I can test that the new certificate is actually working before deleting the old ones? Thanks. Rob ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~
