Some points to troubleshoot an Exchange Server 2007 SSL configuration. For god knows what reason, Microsoft decided that everything needed to be command line, so it’s pretty easy to get stuck.
Starting point – find what certificates are installed
Run the following cmdlet from the Exchange Shell:
Get-ExchangeCertificate
You should see output similar to:
Thumbprint Services Subject ---------- -------- ------- 1B5667CCB803BC4AD13E7E51A .IP.W CN=mail.example.com.... 103F3F32814A48D2416ECC5DB S.... CN=exch-07 43C6A1548782A25ABA425B471 ....W CN=exch-07.example....
The Thumbprint is the identifier used in other cmdlets when referring to a specific certificate. The Services are what the certificate is enabled for; each letter indicates what service(s) are configured:
| Letter | Service |
|---|---|
| S | SMTP – outbound e-mail secured with TLS |
| I | IMAP – inbound e-mail |
| P | POP3 – inbound e-mail |
| U | Unified Messaging – I believe this is for Outlook Anywhere |
| W | Outlook Web Access / IIS – webmail |
You can also get more detailed information about a specific certificate with the following command:
Get-ExchangeCertificate [thumbprint] | fl
Are the certificates enabled for the right things? Are multiple certificates enabled for the same service (as per the example above)? Is the right certificate installed at all? Has the certificate expired? Does the certificate have incorrect or misspelt details in the DN? Etc..
Handy commands:
Turn a specific service on (Outlook Web Access in this example):
Enable-ExchangeCertificate -Thumbprint [thumbprint] -Services IIS
Disable a certificate:
Enable-ExchangeCertificate -Thumbprint [thumbprint] -Services None
Remove a certificate:
This command does what it says on the tin – there is no undo!
Remove-ExchangeCertificate -Thumbprint [thumbprint]
Aside from using the above to fix obvious problems, the Event Viewer contains very useful error codes and explanatory messages in well-formed English (which is just about a first for any Microsoft product, I think). Combination that + Google will provide fixes for most problems.
One thing I’ve seen once or twice is a certificate that the customer swears black-and-blue has been installed and it’s just not showing up in the Get-ExchangeCertificate output. If you look in (the Certificates snap-in in) MMC, it’s there. What’s happened? The customer requested the certificate in Exchange, but imported the certificate response in to MMC directly. Ergo, public and private keys not matched up and certificate not available to Exchange. Delete certificate from MMC, import in to Exchange instead.