CSR GENERATION INSTALLATION ON MICROSOFT EXCHANGE 2007

One nice thing (although there aren’t many) about the new Power Shell with Exchange 2007 is that you can generate a SSL certificate request without having to play with IIS directly.

1. To generate your certificate request file, start up the Power Shell and run the following command (substituting your host and domain names accordingly):

New-ExchangeCertificate -domainname mail.yourdomain.com -Friendlyname -generaterequest:$true -keysize 2048 -path c:\certrequest.txt -privatekeyexportable:$true -subjectname "c=, o=, cn=, s=, l=, ou= "

This will generate a certificate request file in the root of the C: drive.

2. Next go to your Microsoft certificate server web UI (Note the issues using the web UI from Windows Vista How to use Certificate Services Web enrollment pages together with Windows Vista) and request a certificate. Use the CA Administrative tool to approve the certificate request. Next return to the web UI to download the approved certificate in BASE 64 format to the C: of the Exchange 2007 server e.g. c:\yourdomain.cer . At the Power Shell console run the following command (using the appropriate .cer file name):

Import-ExchangeCertificate -path c:\mail.vircom.co.uk.cer

3. This will complete the SSL certificate creation. You can see the new certificate using the Certificates MMC snap-in. Although the certificate has been created Exchange still has to be configured to use it.

SSL CERTIFICATE INSTALLATION ON MICROSOFT EXCHANGE 2007

To install your newly acquired SSL certificate in Exchange 2007, first copy the certificate file somewhere on the server and then follow these instructions:

1. Click on the Start menu, go to All Programs, then Microsoft Exchange Server 2007 and click on Exchange Management Shell.
2. Run the Import-ExchangeCertificate command below. Make sure to specify the path to the certificate file you downloaded and remove any services that you will not be using.

   Import-ExchangeCertificate -path c:\google.p7b | Enable-ExchangeCertificate -Services IMAP, POP, UM, IIS, SMTP

3. If you didn't receive any errors, then it should have installed correctly. Run the Get-ExchangeCertificate command to verify that the certificate is enabled for the correct services. If you aren't sure which thumprint it is, you can view the thumbprint of the certificate you just installed by double-clicking it and looking for the thumbprint on the details tab.




4. If the certificate isn't enabled for the correct services (S=SMTP, I=IMAP, P=POP, U=Unified Messaging, W=Web/IIS) you need to run the Enable-ExchangeCertificate command below. You can copy the thumbprint from the output of the Get-ExchangeCertificate command that you just ran.

   Enable-ExchangeCertificate -Services IMAP, POP, UM, IIS, SMTP -thumbprint 896B74B25F7EBF330C93E56DA2A76CFC6A7

5. After running the Enable-ExchangeCertificate command, run the Get-ExchangeCertificate command again to verify that the certificate is enabled for the correct services.

return to the top

© 1995 - 2009 ipsCA, IPS Certification Authority, S.L. all Rights reserved. Our CPS summarized or complete, CRLs, Root Certificates and legal documents   can be found in our repository Read our  Privacy Policy and Terms of Use