Need help resolving TLS warnings when assigning services to a reissue of our UCC SAN SSL certificate. Exchange 2010 SP2 with Hub, CAS, Mailbox roles (server1).
Due to requirement to eliminate internal host names, we obtained a reissued cert (replacement of original minus the host (NetBIOS) names) from our CA (DigiCert). We also obtained a duplicate of the reissued cert for our second E2K10 SP2 HUB, CAS, Mailbox
(server2, in different office).
Reissued cert lists same FQDNs as currently installed cert:
mail.company.com
mail2.company.com
server1.addomain.company.com
server2.addomain.company.com
autodiscover.company.com
legacyexchange.company.com
DigiCert said internal FQDNs ending in .com were fine.
The common name is (remains) mail.company.com
Our servers' Exchange virtual directories' internal URLs use either internal or external FQDN. None use host (NetBIOS) name. Our receive and send connectors also use either internal or external FQDN in HELO-EHLO response.
Tonight I imported the reissued cert on server1 and tried to assign services (IMAP,POP3,IIS,SMTP) using EMC. I got the following errors and can't figure out if this is to be expected (did not remove original cert first) or if not, why occurred:
WARNING: This certificate will not be used for external TLS connections with an FQDN of 'server1.addomain.company.com' because the CA-signed certificate with thumbprint '<thumbprint-of-original-CA-cert>' takes precedence. The following receive/send
connectors match that FQDN: Default SERVER1, Client SERVER1.
WARNING: This certificate will not be used for external TLS connections with an FQDN of 'mail.company.com' because the CA-signed certificate with thumbprint '<thumbprint-of-original-CA-cert>' takes precedence. The following receive/send connectors
match that FQDN: Incoming from <internal app server, e.g SharePoint>.
When I clicked Finish (did not see how to back out at that point), the reissued cert showed all services (IMAP,POP3,IIS,SMTP) assigned. The original showed IMAP,POP3,SMTP. No error messages in the Application or System Event Logs. In fact, the Transport service
event errors about expiring STARTTLS certificate stopped even though I did not restart Transport service.
I searched for answers here and online but our situation does not appear to match others' causes. For example, the FQDNs used in our connectors match those on the reissued cert. The cert taking precedence is the original CA cert not the Exchange self-signed
cert. Are we missing a setting(s)? Should we remove SMTP from the original cert and if yes, before or after assigning it to reissued cert? The previous times we replaced the SSL cert (because it was expiring) we did not get the warnings. We installed the replacement,
assigned services to it, restarted the Transport Service, waited a few days, then removed the old cert. I don't recall removing SMTP from old cert before removing it.
I was able to reassign services to the original cert (has not yet expired) and remove the reissued cert. The STARTTLS event log errors started up again, of course.
To see if I got the same message on server2, I imported the duplicate of the reissued cert and assigned services. I did not get the TLS warnings. Like server1, the duplicate cert showed all services (IMAP,POP3,IIS,SMTP) assigned. The original cert showed
IMAP,POP3,SMTP.
DigiCert tech support could not determine the problem. Troubleshooting, we generated a new CSR for server1, rekeyed the cert on DigiCert site using new CSR, DigiCert reissued cert, I downloaded it, and tried again. Same error. I again reverted to original
cert and removed the rekeyed reissue. I tried to remove the duplicate from server2 so that both servers were using the original cert, but I got similar TLS warning when trying to do that and am also clueless as to why. I have not restarted the Transport service
yet on server2.
Thanks,
Joan