Exchange 2010 SSL Certificates
On this Page
- What are SSL Certificates Used for with Exchange?
- SSL Certificate Considerations
- Certificate Types
- Host Names
- Requesting, Installing and Enabling SSL Certificates
As with Exchange 2007, SSL certificates are very important for the operation of Exchange 2010, and are a major pain point for Exchange administrators.
The self signed SSL certificate that is installed with Exchange 2010 should be considered a place holder, only used until you can get a commercial signed SSL certificate in place. Furthermore it isn't supported for use with Outlook Anywhere or ActiveSync.
What are SSL Certificates Used for with Exchange?
The SSL certificate is used in a number of places:
- Outlook Web Access, Outlook Mobile Access
The web browser interface for Exchange.
The mobile synchronisation method
- Web Services
This is mainly used by Mac Clients
Used by Outlook 2007 and higher for configuration information. This is also tells Outlook where the availability service is, so without Autodiscover working correctly, Free/Busy information and Out of the Office may not work correctly.
- SMTP Traffic
Exchange 2010 supports opportunist TLS, which means that if both servers support it, the email will be transferred using TLS.
During a migration, it is also common to include the "legacy" host name in the SSL request and use the same SSL certificate for both the new and old deployment.
SSL Certificate Considerations
For any certificates that expire after November 1st 2015, the SSL issuing guidelines will change, meaning that you need to take particular care with the internal DNS configuration.
In the past, you could include the server's real name with the SSL certificate request. Internal only names (such as host.local) will no longer be permitted on SSL certificates from commercial providers, which means a split DNS system is required.
SSL certificates used with Exchange come in three main types.
- Standard, or single name SSL certificates.
These will be the cheapest kind, and will cover just one host name - host.example.com.
However to use them you will have to support SRV records in your external DNS so that you can setup Autodiscover records.
- Wildcard SSL certificates.
These allow any host name in a certain domain to be used - they are in the format of *.example.com.
Not usually advised with Exchange servers as they can cause problems with ActiveSync and Outlook Anywhere.
- Unified Communications (UC or UCC) or Subject Alternative Name (SAN) Certificates.
These are the preferred type of SSL certificates for Exchange. They allow multiple host names to be accessed by the same SSL certificate on the same site. Not to be confused with wildcard certificates, as specific host names are listed. Furthermore, these host names do not have to be in the same domain name - for example you could include autodiscover.example.com and autodiscover.example.co.uk.
SSL providers charge in different ways for the different certificates. Watch for charges for additional host names and for additional server installations.
Our provider - https://certificatesforexchange.com/ does not charge for additional server installations and sells the UCC type in blocks of five host names.
On a single server deployment, your SSL request can be just two host names:
This is your common name, and would be used by everything in the list.
This is the autodiscover host name, and is one of the addresses queried by Outlook 2007 and higher automatically.
You do not, and should not include the RPC CAS Array host name. The RPC CAS Array host name should be a unique name that does not resolve externally.
Requesting, Installing and Enabling SSL Certificates
- SSL Certificate - Request
Making the initial SSL Certificate request using the wizard built in to Exchange 2010.
- SSL Certificate - Response
Installing the response form your SSL provider.
- Web Services and Other Client Access Host Name Adjustments
What to change on Exchange to allow your new certificate to be used correctly.
- SSL Certificate - Enabling Services
Enabling the services in Exchange to use the SSL Certificate.
- SBS 2011 SSL Certificate Instructions
For SBS 2011, special care is needed to install the certificate in the correct order.
- Single Name SSL Certificate
Using Exchange 2010 with a single name SSL certificate