GO Software Pty Limited Map: 27 Tacoma Blvd, Pasadena SA 5042 ABN: ACN: How to Export a Self Signed Server Certificate

Transcription

1 GO Software Pty Limited Map: 27 Tacoma Blvd, Pasadena SA 5042 Phn: Fax: none ABN: ACN: Eml: Web: How to Export a Self Signed Server Certificate Often when you are trying to do something Windows will prompt you about a certificate that it says is not from a trusted certificate authority and do you want to trust it. This message can get quite annoying but here's the way to get rid of it once and for all. I have already exported the certificate for the GO Software Server which you can download from otherwise... We will be Exporting the Main Server certificate from your domain server and importing onto a local PC - which is pretty straight forward. On the Domain Server Click on the START button 2. Choose RUN 3. Enter the word MMC 4. Click on the OK button 5. In the MMC program click on the FILE menu 6. Then click on the ADD/REMOVE SNAP-IN option 7. In the LEFT hand pane double click on CERTIFICATES 8. Select the COMPUTER ACCOUNT radio button 9. Click on the NEXT button 10. Choose LOCAL COMPUTER 11. Click on the FINISH button 12. It should then look like this - Click on the OK button

2 13. Double click on CERTIFICATES (LOCAL COMPUTER) in the left hand pane 14. Double click on PERSONAL in the left hand pane 15. Click on CERTIFICATES in the left hand pane 16. Now RIGHT CLICK on the certificate that you want to export in the RIGHT hand pane (normally the one marked: <ALL>) 17. Click on ALL TASKS 18. Click on EXPORT 19. Select the DO NOT EXPORT THE PRIVATE KEY radio button 20. Click on the NEXT button 21. Select the DER ENCODED BINARY X.509 (.CER) radio button 22. Click on the NEXT button 23. Enter the name and path for where you want to save the certificate file 24. Click on the NEXT button

3 25. Click on the FINISH button Now you can copy this certificate file to a network location so that you can access it when you need to. Simple Way to Import a Self signed Server Certificate You can save the certificate file (eg to your local hard disk and just double click on it to install 1. You should get a screen with the option to INSTALL the certificate 2. Click on INSTALL CERTIFICATE 3. Click on LOCAL MACHINE 4. Click on the NEXT button 5. Choose the option to PLACE ALL CERTIFICATES IN THE FOLLOWING STORE 6. If it's not already showing TRUSTED ROOT CERTIFICATION AUTHORITIES click on the BROWSE button and select this option 7. Click on the NEXT button 8. Click on the FINISH button

4 Another Way to Import a Self signed Server Certificate ON the local computer where you want to import the certificate Click on the START button 2. Choose RUN 3. Enter the word MMC 4. Click on the OK button 5. In the MMC program click on the FILE menu 6. Then click on the ADD/REMOVE SNAP-IN option 7. In the LEFT hand pane double click on CERTIFICATES 8. Select the COMPUTER ACCOUNT radio button 9. Click on the NEXT button 10. Choose LOCAL COMPUTER 11. Click on the FINISH button 12. It should then look like this - Click on the OK button

5 13. Double click on CERTIFICATES (LOCAL COMPUTER) in the left hand pane 14. Click on TRUSTED ROOT CERTIFICATION 15. RIGHT Click on CERTIFICATES 16. Choose ALL TASKS 17. Choose IMPORT 18. Now type in the file name and path of the certificate that you want to import (or browse to it) 19. Click on the NEXT button 20. Choose the option to PLACE ALL CERTIFICATES IN THE FOLLOWING STORE 21. If it's not already showing TRUSTED ROOT CERTIFICATION AUTHORITIES click on the BROWSE button and select this option 22. Click on the NEXT button 23. Click on the FINISH button How to renew a self signed certificate in Exchange Server 2007/2010 etc Exchange self signs a certificate when the server role is first added for all the Exchange services that run in unison with IIS (smtp & owa etc). The certificate expires one year from the date the server was first installed or the date the certificate was assigned manually.

6 First, check the status of the certificate by Click on START 2. Then ALL PROGRAMS 3. Then Microsoft Exchange Server 2xxx 4. Then Exchange Management Shell (not Exchange Management Console) You will then get a black MS-DOS like window 5. Enter the command below which displays all information about the currently assigned certificates and the status of each certificate... Get-ExchangeCertificate FL It is usual that they are more than one certificate listed in the display so find any/all certificate(s) that show an expired date in the field 'NotAfter'. AccessRules : {System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule} CertificateDomains : {Sites, WITS-SERVER.westechit.local} HasPrivateKey : True IsSelfSigned : False Issuer : CN=westechit-WITS-SERVER-CA NotAfter : 22/12/2013 9:47:06 PM NotBefore : 23/12/2011 9:47:06 PM PublicKeySize : 2048 RootCAType : Registry SerialNumber : 61049DE Services : SMTP Status : DateInvalid Subject : CN=Sites Thumbprint : 1F5D80FF6A66EED16EC3742C89BD6DA0E5A4DA60 An expired certificate may cause problems such as connectivity to web services, SMTP transport and Outlook prompting certificate security warnings. Use the following steps to generate a new certificate and enable it to run IIS services: 6. Note down the Thumbprint(s) of any expired certificate(s) or Copy/Paste the thumbprint to a text editor 7. Then enter the command (all on one line) Get-ExchangeCertificate -Thumbprint "1F5D80FF6A66EED16EC3742C89BD6DA0E5A4DA60" New- ExchangeCertificate' But replace the "1F5D80FF6A66EED16EC3742C89BD6DA0E5A4DA60" section with the correct thumbprint data from your previous command. This generates a new certificate, and you will then be prompted to confirm if you want to overwrite the expired certificate and use the new one for the SMTP service. WARNING: This certificate will not be used for external TLS connections with an FQDN of 'WITS-SERVER.westechit.local' because the CA-signed certificate with thumbprint 'EAC3B893BECCE590DC96D4496EDA08472BB60526' takes precedence. The following receive/send connectors match that FQDN: Default SBS2011. Confirm - Overwrite the existing default SMTP certificate? Current certificate: '26F8C091ACA8B560C1043DA4E655CC080D028D55' (expires 15/01/2014 9:18:52 AM) Replace it with certificate: 'E165B09419A2E94CB0A7801EF60485C27FAC415A' (expires 12/02/2019 4:22:46 PM) [Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): A When you run the command above you will notice the new certificate is no longer used to secure IIS services. 8. Make a note of the thumbprint for the new certificate (as shown above) and run the following command replacing the new thumbprint between the quotation marks (all on one line) Enable-ExchangeCertificate - Thumbprint "E165B09419A2E94CB0A7801EF60485C27FAC415A" -Services IIS 9. Be sure to verify all the services are working correctly after renewing and enabling the certificate 10. Test Outlook clients by closing and opening Outlook to ensure there are no longer any security certificate warnings. 11. Finally, Remove the old certificate by typing the following command into the management shell: Remove-ExchangeCertificate -Thumbprint "1F5D80FF6A66EED16EC3742C89BD6DA0E5A4DA60" 12. Then use SERVICES.MSC to make sure that all AUTOMATIC services have started. Copyright 2014 by GO Software Pty Limited