MSExchangeGuru.com

Let’s take a look at how to create a certificate request or CSR using Exchange 2013 EAC (Exchange Administration Center). All the steps mentioned in this article can be achieved using the Exchange management Shell, I just prefer using the EAC for more granular control and a GUI based look.

1. From EAC click on Servers page. Here click on Certificates and now you can see the servername and also that the default certificate is a Self signed cert assigned to services IMAP, POP, IIS and SMTP

2. Now assuming that you want to get a certificate from a third party provider like Godaddy, verisign or Digicert you need to create a CSR or Certificate Signing request. A CSR contains all details encoded within which is specific to your company and domain. Once you have the CSR handy, you may submit it to the certificate provider. Read more about CSR here: http://en.wikipedia.org/wiki/Certificate_signing_request

 

 

 

 

 

 

 

 

 

 

3. In the next window lets type in the friendly name for the certificate:

 

4. I don’t want to use the wildcard certificate option so ill bypass it and go to the next window. Select the server name which will store the details of this certificate

5. In the next screen you are going to type all the URL’s you want to add in the cert. I personally don’t like to include server FQDN’s in my certificate as a hardware load balancer is going to service my internal as well as external users

6. So in the next screen you can see the list of URL’s required in the cert. review it and click next. I have owa, legacy, email, mobile, autodiscover, IMAP and POP added to my domain. All these URL’s are going to point to my hardware load balancer which then points to exchange 2013 CAS servers

Legacy.msexchangeguru.com will point to Exchange 2007.

Exchange 2013 has inbuilt intelligence to proxy client requests to Exchange 2010

7. Next window gives you an option to type all details about your organization. The screenshot is only an example

The Organization Name is your Full Legal Company or Personal Name, as registered.

The Organizational Unit or Department name is the department or branch ordering the certificate such as Information technology, Marketing etc.

The Country maybe a two-digit code or full name.

State and city/Locality are full names, i.e. New York, ‘Massachusetts’.

The Common Name is the Fully Qualified Domain Name (FQDN) for which you are requesting the ssl certificate.

 

8. Now specify the location where you will be storing the CSR request

 

9. Now if you open the CSR request in a notepad it will look like this. Please note that you SHOULD NOT edit this file using a text editor

 

10. It is now time to contact your certificate vendor and present them with this CSR request and get a certificate which is in the CER format.

11. Once you have the certificate, navigate back to EAC certificates section. The status will now be Pending request. Click the complete button.

12. Let’s navigate to the location of the CER file now.

13. Once the certificate is located the status will now change to “Valid”. Note that I have used a windows certification authority to issue my certificate.

If you want to learn how to submit a CSR to a windows certification authority and then issues a Windows Certificate refer to the section – “How to Create a new Certificate using a Windows certification authority” in the article:

Install SSL certificate on EDGE Transport server role for TLS: https://msexchangeguru.com/2012/07/24/edge-server-tls/

14. As you may have noticed, this new certificate do not have any Services assigned to it. Let’s double click on the certificate name now and assign services to it and click Save.

15. Finally, the certificate will look like this

Now click on the details tab and ensure all the Subject Alternative Names are added:

Finally click on the Certification path and ensure the certificate is trusted on the machine. If it is not trusted you will end up in issues later. To resolve that issue refer to the article:

Install SSL certificate on EDGE Transport server role for TLS: https://msexchangeguru.com/2012/07/24/edge-server-tls/

Also, look at EAC and ensure all services are assigned to the certificate.

CSR generation has never been this easy. Please post your feedback in the comments section.

Ratish Nair
MVP Exchange
Team@ MSExchangeGuru

Keywords: Create a new Exchange certificate, How to create a certificate in Exchange 2013, Microsoft Exchange server 2013 certificates, Microsoft Exchange server 2013 certificate generation.

Posted January 18th, 2013 under Exchange 2013, Exchange Tools. RSS 2.0 feed. Leave a response, or trackback.