VIEW MEMBER FEEDACK TO THIS TIP
In order to use Secure Sockets Layer (SSL) for secure communications between servers, a certificate provided by a valid certificate authority is required.
If you're creating a new instance of an Exchange server and want to use SSL on that new server as well, you'll need to move an existing SSL certificate to it.
One possible scenario involves promoting a back-end Exchange server to a front-end Exchange server -- the back-end server would need to have the front-end server's certificate loaded onto it.
The exact process for transferring a certificate isn't difficult, but there are complications that can arise due to the nature of SSL certification and server naming.
First, let's go over the process itself:
- Go to the server with the SSL certificate and open the Internet Information Services Manager.
- Expand the tree of Web sites to expose the Default Web site. Right-click on it and select Properties.
- On the Directory Security tab, click on Server Certificate, and export the certificate to .PFX format.
- AFTER putting the new server into place, copy the .PFX-formatted certificate file to the target server.
- On the target server, go through the same actions: Open IIS Manager -> Default Web Site -> Properties -> Directory Security -> Server Certificate.
- This time, select "Import a certificate from a .PFX file," and provide the file you exported.
SSL should now be enabled on that computer.
When moving a certificate from machine to another in this fashion, the most important thing to keep in mind is that the name of the server -- i.e., the external fully-qualified domain name -- should be exactly the same for both servers.
If the certificate is tied to a specific machine name (the certificate's properties will tell you what the machine name is), and if it's using the server's internal BE name, then you'll need to make sure that any external DNS pointers are updated to indicate the new server.
Otherwise, people from the outside will never be able to access the newly certified server through SSL. Instead, they'll be redirected to the old machine. For external services that depend on SSL, like OWA, this is doubly important.
About the author: Serdar Yegulalp is editor of the Windows Power Users Newsletter.
MEMBER FEEDBACK TO THIS TIP
What if the internal domain name of the back-end server is different from the public domain name of the front-end server?
—Jim H.
******************************************
If the servers do not have the same name, then I strongly suspect you cannot move the SSL certificate. You will probably need to generate a new SSL certificate for the back-end server, one with the proper name.
The best approach is to keep the SSL certificate on the front-end server and use RPC over HTTP (not HTTPS) to access the back-end server per Microsoft's article "How to configure the back-end server to act as a target for the RPC proxy server. "
The other approach is to generate a new SSL certificate specifically for the back-end server. Although -- from what I've read -- it's best to keep the SSL certificate on the front-end server, use RPC over HTTP to talk to the back-end server, and encrypt all traffic between the front-end and back-end servers using IPsec.
Exchange Server security expert Richard Luckett has another perspective on this issue via a slightly different topic: Securing a front-end certificate server.
I hope this helps!
—Serdar Yegulalp, tip author
Do you have comments on this tip? Let us know.
Related information from SearchExchange.com:
Tip: An introduction to SSL security
Ask the Expert: How enabling SSL for OWA affects bandwidth
Ask the Expert: Securing a front-end certificate server
Tip: Issue with Outlook Mobile Access and certificate authorities
Reference Center: Exchange Server authentication tips and resources
Please let others know how useful this tip is via the rating scale below. Do you have a useful Exchange Server or Microsoft Outlook tip, timesaver or workaround to share? Submit it to SearchExchange.com. If we publish it, we'll send you a nifty thank you gift.
