I was talking with a colleague today who was getting ready to upgrade his small Exchange environment from Exchange 2007 to Exchange 2010 and the subject of certificates came up; mainly, the cost of a SAN (Subject Alternative Name) certificate. For smaller environments many organizations either don’t want or can’t afford to spend hundreds of dollars on a SAN certificate. There is, however, a way to roll out Exchange 2010 with a single name SSL certificate as long as a few pre-requisites are met.
Notes:
First and foremost, this is likely not a Microsoft supported configuration. While we’ve rolled it out in small environments with success, it may not be the best fit for you.
This has only been tested with all roles collocated on a single server. We haven’t tested it in highly available environments because it likely won’t work.
For this example, domain.com is the domain name, mail.domain.com is the URL we’re setting all services to and EXCHANGE is the NetBIOS name of the Exchange server.
To give credit where it’s due: I was not the first to think of doing this but instead used Simon Butler’s excellent article on Exchange 2007 with a Single Name SSL Certificate when working with 2007. It was then a logical leap to try applying a similar configuration to Exchange 2010.
Pre-Requisites
1.) An external DNS provider that supports SRV records. You’ll need to insert an SRV record of _autodiscover._tcp.domain.com in DNS for this to work. We use Zerigo for this ourselves and highly recommend them.
2.) Outlook 2007 with the update rollup released June 27, 2007 (Discussed in this Microsoft KB article) to provide support for Exchange Autodiscover via SRV lookup.
3.) Split-horizon DNS to allow mail.domain.com to resolve to different IPs internally and externally. This requires a working knowledge of DNS.
4.) An SSL certificate for mail.domain.com. While you can use any commercial provider you’d like for this, StartSSL provides free single name SSL certificates.
The Steps
1.) Point external DNS for mail.domain.com to the external IP address of the Exchange server.
2.) Create the SRV record _autodiscover._tcp.domain.com with content of mail.domain.com on port 443. Your DNS provider might also have you enter it like this:
Service: _autodiscover
Protocol: _tcp
Port Number: 443
Host: mail.domain.com
3.) Point internal DNS for mail.domain.com to the internal IP address of the Exchange server.
Note:
These examples can be copied and pasted into the text editor of your choice. Then simply replace mail.domain.com with the correct FQDN of your Exchange server and paste the correct command into a PowerShell session on your Exchange 2010 server.
4.) Set the Internal URLs.
Get-AutodiscoverVirtualDirectory | Set-AutodiscoverVirtualDirectory –InternalUrl “https://mail.domain.com/Autodiscover/Autodiscover.xml”
Get-ClientAccessServer | Set-ClientAccessServer –AutodiscoverServiceInternalUri “https://mail.domain.com/Autodiscover/Autodiscover.xml”
Get-WebservicesVirtualDirectory | Set-WebservicesVirtualDirectory –InternalUrl “https://mail.domain.com/Ews/Exchange.asmx”
Get-OabVirtualDirectory | Set-OabVirtualDirectory –InternalUrl “https://mail.domain.com/Oab”
Get-OwaVirtualDirectory | Set-OwaVirtualDirectory –InternalUrl “https://mail.domain.com/Owa”
Get-EcpVirtualDirectory | Set-EcpVirtualDirectory –InternalUrl “https://mail.domain.com/Ecp”
Get-ActiveSyncVirtualDirectory -Server $CASserver | Set-ActiveSyncVirtualDirectory -InternalUrl “https://mail.domain.com/Microsoft-Server-ActiveSync”
5.) Set the External URLs.
Get-AutodiscoverVirtualDirectory | Set-AutodiscoverVirtualDirectory –ExternalUrl “https://mail.domain.com/Autodiscover/Autodiscover.xml”
Get-webservicesVirtualDirectory | Set-webservicesVirtualDirectory –ExternalUrl “https://mail.domain.com/Ews/Exchange.asmx”
Get-OabVirtualDirectory | Set-OabVirtualDirectory –ExternalUrl “https://mail.domain.com/Oab”
Get-OwaVirtualDirectory | Set-OwaVirtualDirectory –ExternalUrl “https://mail.domain.com/Owa”
Get-EcpVirtualDirectory | Set-EcpVirtualDirectory –ExternalUrl “https://mail.domain.com/Ecp”
Get-ActiveSyncVirtualDirectory | Set-ActiveSyncVirtualDirectory -ExternalUrl “https://mail.domain.com/Microsoft-Server-ActiveSync”
6.) Verify they’re all set correctly.
Get-AutodiscoverVirtualDirectory | ft Identity,InternalURL,ExternalUrl
Get-webservicesVirtualDirectory | ft Identity,InternalURL,ExternalUrl
Get-OabVirtualDirectory | ft Identity,InternalURL,ExternalUrl
Get-OwaVirtualDirectory | ft Identity,InternalURL,ExternalUrl
Get-EcpVirtualDirectory | ft Identity,InternalURL,ExternalUrl
Get-ActiveSyncVirtualDirectory | ft Identity,InternalURL,ExternalUrl
Expected output of the above commands is something like this:
[PS] C:\Windows\system32>Get-AutodiscoverVirtualDirectory | ft Identity,InternalURL,ExternalUrl
Identity InternalUrl ExternalUrl
——– ———– ———–
EXCHANGE\Autodiscover (Default Web Site) https://mail.domain.com/autod… https://mail.domain.com/autod…
[PS] C:\Windows\system32>Get-webservicesVirtualDirectory | ft Identity,InternalURL,ExternalUrl
Identity InternalUrl ExternalUrl
——– ———– ———–
EXCHANGE\EWS (Default Web Site) https://mail.domain.com/ews/e… https://mail.domain.com/ews/e…
[PS] C:\Windows\system32>Get-OabVirtualDirectory | ft Identity,InternalURL,ExternalUrl
Identity InternalUrl ExternalUrl
——– ———– ———–
EXCHANGE\OAB (Default Web Site) http://mail.domain.com/OAB https://mail.domain.com/OAB
[PS] C:\Windows\system32>Get-OwaVirtualDirectory | ft Identity,InternalURL,ExternalUrl
Identity InternalUrl ExternalUrl
——– ———– ———–
EXCHANGE\owa (Default Web Site) https://mail.domain.com/owa https://mail.domain.com/owa
[PS] C:\Windows\system32>Get-EcpVirtualDirectory | ft Identity,InternalURL,ExternalUrl
Identity InternalUrl ExternalUrl
——– ———– ———–
EXCHANGE\ecp (Default Web Site) https://mail.domain.com/ecp https://mail.domain.com/ecp
7.) You can verify everything is working by using the Exchange Remote Connectivity Analyzer located at https://www.testexchangeconnectivity.com
8.) Don’t forget to monitor your new Exchange server!
