1

We have an Exchange server with 2 mailboxes in use. And we also have DLs.
We are in the process of creating CSR for new certificate.
We know that 2 URLs are in use and have DNS records published.
Apart from that , should we add the external and internal virtual directory URLs and autodiscover URLs in the certificate.
Some of them have internal DNS records, but I dont see external DNS records published for any of these URLs.
How can we determine what domains need to be added as SAN in certificate.
Wildcard is not an option here.

Thanks

6 Spice ups
2

Hi Poblano,

Please use below steps to add SAN name to certificate.

  1. Generate a new CSR/private key pair

Anytime a SAN is added to an existing cert, a new CSR is required. The CSR must contain all the existing as well as new SANs. Consult your server manual for instructions on how to add SANs to the CSR. The common name for the CSR must be the same as the original certificate.

  1. Access the supplier user portal:

Please see the certificate reissue article for details on how to gain access to this portal.

  1. Reissue Certificate from the user portal

  • Click Reissue Certificate which will take you to the section displayed below.

  • Click Redeem under Edit & Add Additional Domains

  • Enter the CSR created in Step 1 along with the SAN(s) that will be added.

3 Spice ups
3

I know the steps to generate CSR and add SAN names to it.
We are trying to see if all these are required in our new certificate.

4 Spice ups
4

Not sure what you’re SAN allotment is but I would add them, especially for the external virtual directory URLs and autodiscover. You mind have a need for them later on.

1 Spice up
5

You’re running exchange for two mailboxes? I’d sure look in to O365.

2 Spice ups
6

If you already have a certificate, you’ll be able to see what’s on that one and order like-for-like.

If you don’t have one, you want the public DNS records on your cert.

Internally you can use a DNS zone to point clients to the same internal name as external.

If your internal domain is .local I doubt this would be allowed by the CA.

I would add the external DNS names, and use internal DNS to point clients at the server but for the external name.

1 Spice up
7

Exchange SAN SSL certificates should only include external domain names.
In your case, I’m guessing the only ones you need are:

mail.mydomainname.com (assuming that is your naming convention)
autodiscover.mydomainname.com

1 Spice up
8

^this.

Remember the reason --why-- you are putting the DNS entries in your certificate.
The certificate asserts ‘this domain is mine and here is proof’.

If you put a local domain in, which you are not actually authoritative for, outsiders can forge the domain name, and your server will happily accept it, because your certificate just said ‘that is me and all is good’

1 Spice up