• Article

Configuring Certificates on the Server Running Microsoft Exchange Server 2007 Unified Messaging

Topic Last Modified: 2009-01-23

Use the following procedures to configure the certificate on the server running Microsoft Exchange Server 2007 Unified Messaging.

Important

For internal certificates, both the servers running Office Communications Server 2007 R2 and the servers running Microsoft Exchange must trust the same certification authority (CA).

The Exchange Server must be configured with a server certificate in order to connect to Office Communications Servers:

  1. Download the CA certificate for the Exchange Server.
  2. Install the CA certificate for the Exchange Server.
  3. Verify that the CA is in the list of trusted root CAs of the Exchange Server.
  4. Create a certificate request for the Exchange Server and install the certificate.
  5. Assign the certificate for the Exchange Server.

To download the CA certificate

  1. On the server running Exchange Server 2007 SP1 Unified Messaging, click Start, click Run, type http://<name of your Issuing CA Server>/certsrv, and then click OK.

  2. Under Select a task, click Download a CA certificate, certificate chain, or CRL.

  3. Under Download a CA Certificate, Certificate Chain, or CRL, select Encoding Method to Base 64 and click Download CA certificate.

    Note

    You can also specify DER encoding at this step. If you select DER encoding, the file type in the next step of this procedure and in step 10 of To Install the CA certificate is .p7b rather than .cer.

  4. In the File Download dialog box, click Save, and then save the file to the hard disk on the server. (The file will have either a .cer or a .p7b file extension, depending on the encoding that you selected in the previous step.)

To install the CA certificate

  1. On the server running Exchange Server 2007 SP1 Unified Messaging, open Microsoft Management Console (MMC) by clicking Start, clicking Run, typing mmc in the Open box, and then clicking OK.

  2. On the File menu, click Add/Remove Snap-in, and then click Add.

  3. In the Add Standalone Snap-ins box, click Certificates, and then click Add.

  4. In the Certificate snap-in dialog box, click Computer account, and then click Next.

  5. In the Select Computer dialog box, ensure that the Local computer: (the computer this console is running on) check box is selected, and then click Finish.

  6. Click Close, and then click OK.

  7. In the console tree, expand Certificates (Local Computer), expand Trusted Root Certification Authorities, and then click Certificates.

  8. Right-click Certificates, click All Tasks, and click Import.

  9. Click Next.

  10. Click Browse to locate the file, and then click Next. (The file will have either a .cer or a .p7b file extension, depending on the encoding that you selected in step 3 of To download the CA certificate.

  11. Click Place All Certificates in the following store.

  12. Click Browse, and then select Trusted Root Certification Authorities.

  13. Click Next to verify the settings, and then click Finish.

To verify that the CA is in the list of trusted root CAs

  1. On the server running Exchange Server 2007 SP1 Unified Messaging, in MMC, expand Certificates (Local Computer), expand Trusted Root Certification Authorities, and then click Certificates.

  2. In the details pane, verify that your CA is on the list of trusted CAs.

To create a certificate request and install the certificate

  1. On the server running Exchange Server 2007 SP1 Unified Messaging, click Start, click Run, type http://<name of your Issuing CA Server>/certsrv, and then click OK.

  2. Under Select a task, click Request a Certificate.

  3. Under Request a Certificate, click Advanced certificate request.

  4. Under Advanced Certificate Request, click Create and submit a request to this CA.

  5. Under Advanced Certificate Request, select Web server or another server certificate template configured for server authentication.

  6. Under Identifying Information for Offline Template, in the Name box, type the FQDN of the Exchange Server.

    Note

    You must enter the FQDN of the Exchange Server for communications to work.

  7. Under Key Options, click the Store certificate in the local computer certificate store check box.

  8. Click the Submit button in the bottom of the Web page.

  9. In the dialog box that opens asking for confirmation, click Yes.

  10. On the Certificate Issued page, under Certificate Issued, click Install this certificate.

  11. In the dialog box that opens asking for confirmation, click Yes.

  12. Verify that the message "Your new certificate has been successfully installed" appears.

To assign the certificate

  1. On the server running Exchange Server 2007 SP1 Unified Messaging, open MMC.

  2. In the console tree, expand Personal and then click Certificates.

  3. In the details pane, verify that personal certificate is displayed.

  4. Double click the certificate to read its details and ensure it is valid.

    Note

    It may take a few minutes before the certificate displays as valid.

  5. Restart the Microsoft Exchange Unified Messaging service.

    Note

    The server running Exchange Server 2007 SP1 Unified Messaging automatically retrieves the correct certificate.

  6. Open Event Viewer and look for Event ID 1112, which specifies what certificate the server running Exchange Server 2007 SP1 Unified Messaging has retrieved.