LAB: Exchange 2007 UM Configuration – UM Cerfificate

-

 

 

Request certificate

簡單的憑證部署案例是將相同的協力廠商商業或 PKI 憑證匯入每部已安裝下列伺服器角色的 Exchange 2007 伺服器：Unified Messaging、Client Access 和 Hub Transport。也請將這個信任的憑證安裝在每部執行 Office Communications Server 2007 的電腦上。這樣有助於簡化憑證部署，以及減少部署憑證的相關系統管理額外負荷。不過，您必須取得支援主體別名 (SAN) 的信任憑證。

如果您使用 SIP 安全或安全的撥號對應表，則在 Unified Messaging Server 與 IP 閘道之間，或使用直接 SIP 連線時，都需要有信任的憑證。如果使用 SIP 安全或安全的撥號對應表，則可以使用 Communication Server 2007 電腦與 Unified Messaging、Client Access 和 Hub Transport Server 之間使用的相同信任憑證。

  • 雖然您可以將 Unified Messaging server role 與其他 Exchange 2007 伺服器角色安裝在同一台電腦上，但是當您部署 Communications Server 2007 時，建議您將 Unified Messaging server role 安裝在不會執行其他 Exchange 2007 伺服器角色的電腦上。如果在 Unified Messaging server role 的相同電腦上安裝其他伺服器角色，則 Microsoft Exchange 整合通訊服務可能會選取不正確的憑證，而且無法使用相互 TLS 來加密流量。原因是憑證中找到的主體別名有所限制。

    例如，如果您先安裝 Unified Messaging server role，之後再於同一部伺服器上安裝 Client Access server role，則 Microsoft Exchange 整合通訊服務會使用 Client Access server role 所建立的憑證，而不是安裝 Unified Messaging server role 時所建立的憑證。原因是 Microsoft Exchange 整合通訊服務會在信任的根存放區中尋找到期時間最久的憑證。
  • 因為信任的憑證使用相互 TLS 來建立與 Communications Server 2007、Client Access、Hub Transport 和 Unified Messaging Server 的加密通道，所以相互 TLS 交涉期間使用之憑證上的名稱必須符合呈現憑證之伺服器的網域全名 (FQDN)。

    如果 Unified Messaging Server 的信任根憑證授權單位儲存區中沒有 PKI、商業性憑證或自行簽署憑證，則 Microsoft Exchange 整合通訊服務會建立另一個自行簽署憑證並用來進行相互 TLS。


    •  image

    clip_image004

    clip_image006

    clip_image008 

    image

    clip_image012

    Import Certificate
    clip_image014

    Get Thumbprint 
    image


    Enable Certificate
    clip_image018 


    image

     

    Blog Extended Reading

    1. REF: Exchange 2007 UM integrated with OCS R2 – Overall
    2. LAB: Exchange 2007 UM Configuration – UM Cerfificate
    3. Lab: Exchange 2007 UM integrated with OCS R2 – Part1 –UM Dialplan & OCS Location Profiles
    4. Lab: Exchange 2007 UM integrated with OCS R2 – Part2 –exchucutil.ps1
    5. Lab: Exchange 2007 UM integrated with OCS R2 – Part3 - ocsumutil.exe


    More Information & Reference

    1. 設定整合通訊及 Office Communications Server 2007

    image

    Comments

    Post a Comment

    Popular posts from this blog

    E15 CU3–Update Failed–AD replicated Exceeded the tombstone lifetime.

    -
    Image
      Exchange 2013 CU3 The naming context is in the process of being removed or is not replicated http://technet.microsoft.com/en-us/library/replication-error-8452-the-naming-context-is-in-the-process-of-being-removed-or-is-not-replicated-from-the-specified-server(v=ws.10).aspx   C:\> REPADMIN /SHOWREPS Root\RDC01 DSA Options: IS_GC Site Options: (none) DSA object GUID: f1694974-47c4-4555-a214-db3c86854aeb DSA invocationID: f1694974-47c4-4555-a214-db3c86854aeb ==== INBOUND NEIGHBORS ====================================== CN=Schema,CN=Configuration,DC=lab7,DC=root     TW\AD02 via RPC         DSA object GUID: bfcc1053-e1da-46fd-8b9d-179c7992...
    Read more

    202301 - Exchange onpreme - PowerShell Serialization Payload Signing

    -
    Image
    Released: January 2023 Exchange Server Security Updates https://techcommunity.microsoft.com/t5/exchange-team-blog/released-january-2023-exchange-server-security-updates/ba-p/3711808 https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/SerializedDataSigningCheck/ 1.  Update KB5022143 (Exchange SU) 2. Run latest HealthCherker 3.  PowerShell Serialization Payload Signing https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/SerializedDataSigningCheck/ Certificate signing of PowerShell serialization payload in Exchange Server https://support.microsoft.com/en-us/topic/certificate-signing-of-powershell-serialization-payload-in-exchange-server-90fbf219-b0dd-4b2c-8a68-9d73b3309eb1 4.  MonitorExchangeAuthCertificate    https://microsoft.github.io/CSS-Exchange/Admin/MonitorExchangeAuthCertificate/ 5.                 New-SettingOverride -Name "EnableSigningVerification" -Component Data -Secti...
    Read more

    Ticket: RemoteAPP certificate revocation check error

    -
    Image
      . certutil -f –urlfetch -verify <your_certificate>.cer From internet client (Win7 ultimate x64) Issuer:     CN=TWCA Secure CA -Evaluation Only     OU=SSL Certification Service Provider-Evaluation Only     O=TAIWAN-CA INC.     C=TW Subject:     CN=deep2.msft.com     OU=ITS     O=Msft Corporation     L=Taipei     S=Taiwan     C=TW Cert Serial Number: 04bd dwFlags = CA_VERIFY_FLAGS_ALLOW_UNTRUSTED_ROOT (0x1) dwFlags = CA_VERIFY_FLAGS_IGNORE_OFFLINE (0x2) dwFlags = CA_VERIFY_FLAGS_FULL_CHAIN_REVOCATION (0x8) dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000) dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000) ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN (0x20000000) HCCE_LOCAL_MACHINE CERT_CHAIN_POLICY_BASE -------- CERT_CHAIN_CONTEXT -------- ChainContext.dwErrorStatu...
    Read more