Friday, June 22, 2012
Sunday, December 18, 2011
How to renew a Self-Signed certificate in Exchange Server 2007
How to renew a self signed certificate in Exchange Server 2007
When a new Exchange Server 2007 role is installed on a computer the server automatically generates a self signed certificate to be used with services like transport (SMTP), POP, IIS (OWA and Exchange Web Services) and IMAP. This certificate expires right after the completion of one year from the date server was installed or the certificate was reassigned manually. To check the status of the certificate using Exchange Management Shell. Executing the cmdlet Get-ExchangeCertificate |FL displays all relevant information about all the certificates assigned, enabled and being used or not used by Exchange Services.
You may see more than one certificate listed on your exchange server(s) and that may be simply because you or someone else from your team have already tried working with certificates on the server.
If you see the above picture, you will notice that the certificate I have on my server is valid till 24th March 2010. NotAfter holds the value in mm/dd/yyyy h:mm:ss format. NotAfter – means this certificate will not be valid after the time stamp listed in this field. On the other hand the value NotBefore – means that this certificate will not be valid before the time stamp mentioned.
So once you cross the date listed in field NotAfter the certificate becomes invalid and indeed may open up doors to many other troubles like connectivity to web services, SMTP transport, POP and IMAP retrieval, etc. To renew the certificate you can simply run a cmdlet and get a new self signed certificate. But, this is just not as simple as simply running a cmdlet and get a new certificate, there is a procedure to do it. Check the following steps:
1. Run Get-ExchangeCertificate |FL – This will list details of all certificates that you have assigned to Exchange Services. Please understand, this cmdlet does not retrieve any information about any other certificate from local certificate store which is not used by Exchange. Once you get the output printed on the screen; note down the Thumbprint of certificate into a notepad.
2. Run Get-ExchangeCertificate –Thumbprint “58C846DEEA2865CA9E6DD4B42329A9AC994EBF63” | New-ExchangeCertificate . This renews the certificate. You will notice the moment you press enter on keyboard you may be prompted to confirm if you want to use the same certificate for SMTP service.
3. Check if the certificate is renewed. This can be simply examined by looking at the changes in thumbprint of the certificate after running the cmdlet mentioned in step 2. You can see the changed thumbprint in below picture.
4. Looking correctly to the above picture you will also notice that the certificate is not being used to secure IIS based services anymore though the NotAfter and NotBefore dates have changed. To enable this renewed certificate for IIS as well run Enable-ExchangeCertificate – Thumbprint “E0BB201793DC74D0F94F3275E6AA53BA75907565” –Services IIS
5. Verify all the services are working correctly after renewing and enabling the certificate.
6. Remove old certificate by running Remove-ExchangeCertificate –Thumbprint “58C846DEEA2865CA9E6DD4B42329A9AC994EBF63”
source: http://www.msexchangegeek.com/2009/04/24/how-to-renew-a-self-signed-certificate-in-exchange-server-2007/
Tuesday, October 20, 2009
Exchange 2007 OWA not Working
Issue these commands from the Exchange 2007 Management Shell.
1. remove-owavirtualdirectory -Identity "owa (Default Web Site)" (Note the website name is case sensitive)
2. New-owavirtualdirectory –Name “owa” –website “Default Web Site”
You will likely have to re-add the certificate and\or re-enable Forms Based Authentication if applicable.
3. Re-register the .NET 2.0IIS 6.0 supports both the 32-bit mode and the 64-bit mode. However IIS 6.0 does not support running both modes at the same time on a 64-bit version of Windows. ASP.NET 1.1 runs only in 32-bit mode. ASP.NET 2.0 runs in 32-bit mode or in 64-bit mode. Therefore, if you want to run ASP.NET 1.1 and ASP.NET 2.0 at the same time, you must run IIS in 32-bit mode.
Note If you have Microsoft Exchange Server 2007 installed on the computer, use the instructions for ASP.NET 2.0, 64-bit version.
Before you can switch between the different versions of ASP.NET, visit the following Microsoft Developer Network (MSDN) Web site to download and install both the .NET Framework 1.1 and the .NET Framework 2.0:
- The .NET Framework Version 2.0 Redistributable Package x64 (64 Bit)
- The .NET Framework Version 1.1 Redistributable
ASP.NET 1.1, 32-bit version
To run the 32-bit version of ASP.NET 1.1, follow these steps:- Click Start, click Run, type cmd, and then click OK.
- Type the following command to enable the 32-bit mode:cscript %SYSTEMDRIVE%\inetpub\adminscripts\adsutil.vbs SET W3SVC/AppPools/Enable32bitAppOnWin64 1
- Type the following command to install the version of ASP.NET 1.1 and to install the script maps at the IIS root and under:%SYSTEMROOT%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe -i
- Make sure that the status of ASP.NET version 1.1.4322 is set to Allowed in the Web service extension list in Internet Information Services Manager.
ASP.NET 2.0, 32-bit version
To run the 32-bit version of ASP.NET 2.0, follow these steps:- Click Start, click Run, type cmd, and then click OK.
- Type the following command to enable the 32-bit mode:cscript %SYSTEMDRIVE%\inetpub\adminscripts\adsutil.vbs SET W3SVC/AppPools/Enable32bitAppOnWin64 1
- Type the following command to install the version of ASP.NET 2.0 (32-bit) and to install the script maps at the IIS root and under:%SYSTEMROOT%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe -i
- Make sure that the status of ASP.NET version 2.0.50727 (32-bit) is set to Allowed in the Web service extension list in Internet Information Services Manager.
ASP.NET 2.0, 64-bit version
To run the 64-bit version of ASP.NET 2.0, follow these steps:- Click Start, click Run, type cmd, and then click OK.
- Type the following command to disable the 32-bit mode:cscript %SYSTEMDRIVE%\inetpub\adminscripts\adsutil.vbs SET W3SVC/AppPools/Enable32bitAppOnWin64 0
- Type the following command to install the version of ASP.NET 2.0 and to install the script maps at the IIS root and under:%SYSTEMROOT%\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe -i
- Make sure that the status of ASP.NET version 2.0.50727 is set to Allowed in the Web service extension list in Internet Information Services Manager.
In Exchange Manager, disable Outlook Anywhere, IISRESET, Enable OutlookAnywhere, IISRESET
In EM set the path properties and set Forms Authenticaion, disbale Anonymous access, Turn on Require SSL in IIS
IISRESET