Exchange 2016/2019: SSL Certificate Installation Guide

This is a complete guide to SSL certificate administration on Exchange 2016/2019, including DNS planning, Split-DNS setup, CSR generation, certificate installation, and service activation.

Switching from Internal to Publicly Valid Server Names

When Exchange is installed, the default configuration often uses internal server names for internal communication. However, it is no longer possible to include internal server names or non-routable domains in publicly issued SSL certificates. Since Exchange cannot assign multiple certificates to a single service, you must use externally valid FQDNs (Fully Qualified Domain Names) for all services.

Examples of internal server names that are no longer supported:

• server01
• exch01.fairssl.local
• srv01.domain.lan
• localhost
• 192.168.100.10
• 10.0.0.10

This requires one or more DNS names that can be accessed both internally and externally, pointing to the Exchange server. The Exchange server must then be configured to recognise these names.

We recommend one of the following two common solutions:

Split-DNS

A single DNS name, such as webmail.fairssl.dk, resolves to the internal IP address of the Exchange server on the local network, while resolving to the public IP address from the internet.

If you do not want to create the entire domain as a split-DNS zone, we recommend creating the server name itself as a sub-zone, thereby only implementing split-DNS for that specific record.

See the section on Setting up Split-DNS below.

Once configured, set the server's internal and external URL addresses to this single name.

Two DNS Names

In this scenario, different DNS names are used for internal and external access. This is common for companies using a sub-domain for their public presence, such as intern.fairssl.dk.

For example, webmail.fairssl.dk could point to the external IP, while exchangeint.fairssl.dk points to the internal IP.

You then simply configure the Exchange internal and external URLs to match these respective names.

Setting up Split-DNS

1. Log in to the Domain Controller using an administrator account.

2. Press Windows Key + R and type the following command to open the DNS Manager:

dnsmgmt.msc

3. Right-click Forward Lookup Zones and select New Zone.

4. Click Next.

Select Primary zone and Store the zone in Active Directory if available.

Click Next.

5. Select To all DNS servers running on domain controllers in this forest.

Click Next.

6. Enter the DNS name that the internal DNS should point to (e.g. mail.fairssl.dk).

You can also choose to use the entire domain (e.g. fairssl.dk), but this requires creating a host record for every single DNS name used by your organisation (see step 9).

Click Next.

7. Select Allow only secure dynamic updates.

Click Next, then Finish.

8. Right-click the new forward zone and select New Host (A or AAAA).

9. Leave Name blank.

Enter the internal IP address of the Exchange server.

If you have a reverse lookup zone or plan to create one, check Create associated pointer (PTR) record; otherwise, leave it blank.

Click Add Host.

10. If you chose to create a zone for the entire domain, follow this step for every DNS name you use (e.g. www.domain.dk, vpn.domain.dk, login.domain.dk).

Enter the DNS name without the domain in the Name field (e.g. mail).

Enter the internal IP address of the Exchange server.

Check Create associated pointer (PTR) record if applicable.

Configuring Internal and External Exchange Service URLs

1. Log in to the Exchange server holding the Client Access Server (CAS) role. Use an account that is a member of the "Exchange Administrators" group and the local "Administrators" group.

2. Launch the Exchange Management Shell by right-clicking the shortcut and selecting Run as Administrator.

3. Type the following command and press [ENTER]:

Get-ExchangeServer | fl name

4. Run the following command, where SERVERNAVN is the name found in step 3, INTERNURL is the internal address (e.g. exch01.fairssl.dk or mail.fairssl.dk), and EKSTERNURL is the external address without https:// (e.g. mail.fairssl.dk). Ensure you use double quotes:

$CASserver = "SERVERNAVN" ; $internalURL= "INTERNURL" ; $externalURL= "EKSTERNURL"

5. Copy and paste the following commands to update the virtual directory URLs to the publicly valid names:

Get-AutodiscoverVirtualDirectory -Server $CASserver | Set-AutodiscoverVirtualDirectory -InternalUrl "https://$internalURL/Autodiscover/Autodiscover.xml" -ExternalUrl "https://$externalURL/Autodiscover/Autodiscover.xml"

Get-ClientAccessService -Identity $CASserver | Set-ClientAccessService -AutodiscoverServiceInternalUri "https://$internalURL/Autodiscover/Autodiscover.xml"

Get-WebservicesVirtualDirectory -Server $CASserver | Set-WebservicesVirtualDirectory -InternalUrl "https://$internalURL/Ews/Exchange.asmx" -ExternalUrl "https://$externalURL/Ews/Exchange.asmx"

Get-OabVirtualDirectory -Server $CASserver | Set-OabVirtualDirectory -InternalUrl "https://$internalURL/Oab" -ExternalUrl "https://$externalURL/Oab"

Get-OwaVirtualDirectory -Server $CASserver | Set-OwaVirtualDirectory -InternalUrl "https://$internalURL/Owa" -ExternalUrl "https://$externalURL/Owa"

Get-EcpVirtualDirectory -Server $CASserver | Set-EcpVirtualDirectory -InternalUrl "https://$internalURL/Ecp" -ExternalUrl "https://$externalURL/Ecp"

Get-ActiveSyncVirtualDirectory -Server $CASserver | Set-ActiveSyncVirtualDirectory -InternalUrl "https://$internalURL/Microsoft-Server-ActiveSync" -ExternalUrl "https://$externalURL/Microsoft-Server-ActiveSync"

6. The following is a combined one-liner containing all the above commands for easier execution:

Get-AutodiscoverVirtualDirectory -Server $CASserver | Set-AutodiscoverVirtualDirectory -InternalUrl "https://$internalURL/Autodiscover/Autodiscover.xml" -ExternalUrl "https://$externalURL/Autodiscover/Autodiscover.xml" ; Get-ClientAccessService -Identity $CASserver | Set-ClientAccessService -AutodiscoverServiceInternalUri "https://$internalURL/Autodiscover/Autodiscover.xml" ; Get-WebservicesVirtualDirectory -Server $CASserver | Set-WebservicesVirtualDirectory -InternalUrl "https://$internalURL/Ews/Exchange.asmx" -ExternalUrl "https://$externalURL/Ews/Exchange.asmx" ; Get-OabVirtualDirectory -Server $CASserver | Set-OabVirtualDirectory -InternalUrl "https://$internalURL/Oab" -ExternalUrl "https://$externalURL/Oab" ; Get-OwaVirtualDirectory -Server $CASserver | Set-OwaVirtualDirectory -InternalUrl "https://$internalURL/Owa" -ExternalUrl "https://$externalURL/Owa" ; Get-EcpVirtualDirectory -Server $CASserver | Set-EcpVirtualDirectory -InternalUrl "https://$internalURL/Ecp" -ExternalUrl "https://$externalURL/Ecp" ; Get-ActiveSyncVirtualDirectory -Server $CASserver | Set-ActiveSyncVirtualDirectory -InternalUrl "https://$internalURL/Microsoft-Server-ActiveSync" -ExternalUrl "https://$externalURL/Microsoft-Server-ActiveSync"

Generating a CSR for Certificate Ordering

1. Log in to the Exchange server with the CAS role using an account with the appropriate administrative privileges.

2. Press the Windows Key, type Exchange ad, and launch the Exchange Admin Center (EAC).

3. Enter your administrator credentials and click Sign In.

4. Click Servers in the left-hand menu, then select the server that requires the certificate from the list.

5. Click Certificates in the top right, then click the + (plus) icon.

6. Select Create a request for a certificate from a certificate authority and click Next.

7. Enter a Friendly Name for the certificate (e.g. the primary DNS name) and click Next.

8. Ensure Request a wildcard certificate is unchecked and click Next.

9. Click Browse, select the server, and click Next.

10. Specify which DNS names should be used for the various Exchange services.

If any names use .local or internal addresses, they must be changed. See Switching from Internal to Publicly Valid Server Names. You can proceed with the CSR and update the URLs later.

Click Next.

11. Review the list of Subject Alternative Names (SANs). Remove any you don't need and add any required names.

Click Next.

12. Enter your organisation's information:

• Organization name: Enter the full legal name of your company.
• Department Name: Can be left blank.
• City/Locality: The full city name.
• State/Province: The county or region name.
• Country/Region: Select the country where the organisation is registered.

Click Next.

13. Enter the UNC path where you want to save the CSR file (e.g. \\EX2016\c$\www.fairssl.dk.csr).

Click Finish.

14. Open the CSR file with a text editor like Notepad and copy the entire block of text into the order form on fairssl.com.

Importing the Intermediate CA Certificate

To ensure that clients can verify the trust chain, the public intermediate certificate from the Certificate Authority must be installed on the Exchange server.

Note: Windows sometimes installs this automatically during the server certificate import. However, manually importing it is safe; if it already exists, you will simply receive a notification.

1. Log in to the server as an Administrator. Copy the intermediate certificate text from your issuance email into Notepad and save it to your desktop as intermediate.cer.

2. Press Windows Key + R, type mmc.exe, and click OK.

3. Go to File > Add/Remove Snap-in.

4. Select Certificates and click Add.

5. Select Computer account and click Next.

6. Select Local computer and click Finish, then OK.

7. Expand Certificates (Local Computer) > Intermediate Certification Authorities.

Right-click Certificates, select All Tasks, and click Import....

8. Click Browse..., select the intermediate.cer file from your desktop, and click Next.

9. Select Automatically select the certificate store based on the type of certificate, then click Next and Finish.

Installing the Certificate from a Pending Request

It is critical to install the certificate on the same server where the CSR was generated, as the private key is stored there. The installation process binds the issued certificate to the existing private key.

1. Save your new certificate file in a location accessible via a UNC path (e.g. \\exserver\c$\admin\certnew.cer).

2. Launch the Exchange Admin Center (EAC) from the Start menu.

3. Log in with your administrator credentials.

4. Navigate to Servers > Certificates. Select the server where the certificate will be installed.

5. Select the Friendly Name you created for the CSR. It should have a status of Pending Request. Click Complete in the right-hand pane.

6. Enter the UNC path to the certificate file and click OK.

7. The certificate is now installed, and its status will change from Pending Request to Valid.

Assigning the Certificate to Services

1. Log in to the Exchange CAS server as an Administrator.

2. Open the Exchange Admin Center.

3. Navigate to Servers > Certificates.

4. Select the new certificate you wish to activate and click the Edit (pencil) icon.

5. Select Services from the left-hand menu. Check the services you want to bind to this certificate (e.g. IIS, SMTP). Click Save.

6. If you select SMTP, you will be prompted to overwrite the default SMTP certificate. Click Yes.