self signed certificate

Hi i am using exchange server 2007, its an internal exchange not connected to outside world and i have just renewed self signed certificate and i have deployed on all computers using GPO.(Computer Config-Polices-Windows Settings-Security Settings-Public Key polices-Trusted Root Certification Authority)(Is this GPO correct?)

Now i will migrate from Exchange 2007 to Exchange 2013. After the migration, Do i need to renew the certificate and export the certificate and deploy through GPO, I am not aware of self signed certificate after the migration. Experts guide me? 

February 26th, 2015 3:58am

Hi 

When you install Exchange 2013, a self-signed certificate is automatically configured on the Mailbox servers. A self-signed certificate is signed by the application that created it. The subject and the name of the certificate match. The issuer and the subject are defined on the certificate. This self-signed certificate is used to encrypt communications between the Client Access server and the Mailbox server. The Client Access server trusts the self-signed certificate on the Mailbox server automatically, so no third-party certificate is needed on the Mailbox server. When you install Exchange 2013, a self-signed certificate is also created on the Client Access server. This self-signed certificate will allow some client protocols to use SSL for their communications. Exchange ActiveSync and Outlook Web App can establish an SSL connection by using a self-signed certificate. Outlook Anywhere won't work with a self-signed certificate on the Client Access server. Self-signed certificates must be manually copied to the trusted root certificate store on the client computer or mobile device. When a client connects to a server over SSL and the server presents a self-signed certificate, the client will be prompted to verify that the certificate was issued by a trusted authority. The client must explicitly trust the issuing authority. If the client confirms the trust, then SSL communications can continue.

Summary - 

for outlook (outlook anywhere) you need to have a third party certificate because all the connections internal and external in exchange 2013 are Outlook Anywhere

Source of Information - 

https://technet.microsoft.com/en-us/library/dd351044(v=exchg.150).aspx

Free Windows Admin Tool Kit Click here and download it now
February 26th, 2015 4:24am

No, you will have to keep exchange 2013 ready even before you start migrating exchange 2007 to 2013.
As you are using Internal CA I don't see a reason why would you renew the old cert. I would get a new certificate requested from Exchange 2013, install it and configure it.

Why would you deploy Cert from GPO!
http://www.exchangeranger.com/2014/12/how-to-request-and-configure-exchange.html

1: Request new Cert for Exchange 2013.
2: Download the new Cert from CA Server
3: Install it on Exchange 2013
4: Configure the Cert on Exchange 2013.
5: Enable the services on Cert on Exchange 2013.
6: Test the services, like OWA, Outlook and other.
Once all is successful, you are ready to migrate exchange 2007 to 2013 (at least as per certificate point of view)

February 26th, 2015 5:00am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics