Importing Certificates to Exchange 2007 servers

In my previous blogs (http://khurramullah.wordpress.com/2009/07/01/command-for-generating-csr-for-exchange-servers/ and http://khurramullah.wordpress.com/2009/07/01/exchange-2007-certificate-request-generator/) i have discussed how we can generate CSR for different exchange roles. Here i will discuss how we can import certificates to different exchange roles. Following is the command for importing certificates;

Import-ExchangeCertificate -Path “c:\path\generated SAN certif_name.cer” –friendlyname “<Certificate Friendly Name>”

After running this command successfully you should be seeing the thumbprint of the new certificate. Copy the full thumbprint value because you will required this in the next commands.

Now you have to enable your certificate for specific services for example for SMTP and Web services.

For enabling CAS server certificates run this command:

Get-exchangecertificate <Thumbprint>| enable-exchangecertificate -services "IIS”

 

For enabling Edge server certificates run this command

Get-exchangecertificate <Thumbprint>| enable-exchangecertificate -services "SMTP”

After running above command run Get-exchangecertificate again for verifying if services are enabled or not.

You can also combine the above 2 commands like this;

Import-ExchangeCertificate -Path “c:\path\generated SAN certif_name.cer” –friendlyname “<Certificate Friendly Name>” | enable-exchangecertificate -services "IIS”

Following are the possible values for services parameter;

• IMAP
• POP
• UM
• IIS
• SMTP
• None

Do not import exchange certificate by normal certificate importing methods (import from certificate MMC Snap in) otherwise certificate will not going to work. Also make sure you have Trusted root CA and Intermediate CA certificates installed in their relevant stores otherwise certificate will have issues.

In case you want to import or apply the same certificate to another Edge or CAS server then you need to perform following addition steps;

1. Open Certificate MMC Snap in on the server for local computer.

2. Go to personal container and locate the certificate which you had just imported.

3. Export this certificate with private key.

5. Copy this certificate on the server where you want to configure this certificate.

6. Run following command on the second server which you want to configure from the same certificate;

Import-ExchangeCertificate -Path c:\path\<certificate file>.pfx –Password:(Get-Credential).password

The Get-Credential cmdlet in the above command pops up a standard username\password dialog box. This is little bit confusing because we don’t need a username to get to the keys, just put whatever you want for the username, but put the password that you used when you ran the Export certificate wizard the Certificate Manager snap-in in MMC.

7. Run command Get-ExchangeCertificate to get the thumbprint of this certificate.

8. Run command EnableCertificate –thumbprint <copy the thumbprint> -services “IIS”

9. After running above command run Get-exchangecertificate again for verifying if services are enabled or not.

Command for Generating CSR for Exchange servers

During Edge server configuration, you are required to bind a certificate to edge server for securing edge server communication. For this you have to run a powershell command which will generate a required CSR for you ( I have discussed a tool for CSR generation in my previous blog http://khurramullah.wordpress.com/2009/07/01/exchange-2007-certificate-request-generator/). Here in this blog i will discuss the powershell command for CSR generation. A typical command will be like this

New-ExchangeCertificate -GenerateRequest -Path c:\Server1_Contoso_com.csr -KeySize 1024 -SubjectName "c=SG, s=, l=Singapore, o=Fictious Enterprise, ou=Information Technology, cn=Server1.Contoso.com"  -PrivateKeyExportable $True

 

There are some important parameters in this command which i will discuss below

Path: The path where the CSR file will save.

KeySize: possible values are 1024, 2048.

Subject Name: Subject name consists of different parameters which are;

c=Country, c=State, I=City, o= organization, ou=organization unit or department, cn=common name (for example the public name of your website)

 

PrivateKeyExportable: This will mark the key as exportable so you can backup it and deploy it to another server if required.

Exchange 2007 Certificate Request Generator

Generating CSR for any exchange 2007 role is little bit tricky and required a quite long Powershell command to run. For making it lot simpler a company named as digicert has published a free tool on internet which is accepting different parameters and provide us a powershell command which we can run and generate CSR for any server role, Following is the link of this tool;

DigiCert’s Exchange 2007 CSR generation Tool

https://www.digicert.com/easy-csr/exchange2007.htm