Modifying Exchange SCP due to SAN limitation

One of my customer's Exchange server private SSL is expiring soon and they plan to go for SSL certificate from public certification authority.Due to budget issue, they only plan to purchase 1 certificate with 2 SAN which is webmail.contoso.com and autodiscover.contoso.com.

Since the internal domain name(contoso.internal) is different with public domain(contoso.com), they asked me is it possible to consolidate both into one(contoso.com) without causing any service interruption to users, for example certificate warning when they open Outlook client.

To achieve the goal, all we need to do is to modify Exchange SCP(service connection point), to point the internal autodiscover URL to autodiscover.contoso.com.

Set-ClientAccessServer -Idendity CAS_Server_Name -AutodiscoverServiceInternalUri "https://autodiscover.contoso.com/autodiscover/autodiscover.xml"

Set-WebServicesVirtualDirectory -Idendity "CAS_Server_Name\EWS (Default Web Site)" -InternalUrl "https://webmail.contoso.com/EWS/exchange.asmx"

Set-OABVirtualDirectory -Idendity "CAS_Server_Name\OAB (Default Web Site)" -InternalUrl "https://webmail.contoso.com/oab"

By modifying the SCP and virtual directories internal URL pointing to the public domain name instead of internal domain name, we can achieve the goals of spending minimum amount of money on public SSL.

Exchange 2010 The Certificate Status could not be determined because the revocation check failed

I helped my customer to renew SSL certificate for Exchange yesterday but I ran into some issue.

My customer’s environment is having a proxy server to handle internet connection for all users. In the Exchange server I already specified Exchange server name in the bypass list but when I import the certificate into CAS, an error The Certificate Status could not be determined because the revocation check failed will display in EMC.

I downloaded the Digicert Certificate Utility for Windows here to test the proxy settings, certificate revocation status and it passes all the test, but unfortunately whenever I re-import the certificate it will display the previous error.

Finally I decided to import the certificate using Powershell.

First I import the certificate without assigning services with below command:

Import-ExchangeCertificate -FileData ([Byte[]]$(Get-Content -Path c:\certificate.pfx -Encoding byte -ReadCount 0)) -Password:(Get-Credential).password

Then I assign services (POP, IMAP, IIS ,SMTP) to the certificate with below command:

Enable-ExchangeCertificate -Thumbprint certificate_thumb_print  -Services POP,IMAP,SMTP,IIS

The command executed successfully, and when I browse to the OWA page it is showing that it has the valid certificate now, however in the EMC it is still showing the revocation check failed error.

I’m suspect there are something needed to configure on the proxy server, however this is a workaround for myself to get Exchange services published with the valid SSL certificate.