Exchange 2007: An internal transport certificate expired

I guess the main reason for this posting is more informative than to help people solve this but I was astounded when I did more digging into it. I had users calling me saying they were receiving Exchange dialogue boxes telling them the certificate was invalid or had expired.

Following up I found the below in Event Viewer:

Event Type: Error
Event Source: MSExchangeTransport
Event Category: TransportService
Event ID: 12014
Date: 16/02/2009
Time: 09:18:53
User: N/A
Computer: SERVER2K3-SBS
Description:
Microsoft Exchange couldn't find a certificate that contains the domain name server2k3-sbs.DOMAIN.internal in the personal store on the local computer. Therefore, it is unable to support the STARTTLS SMTP verb for the connector Default SERVER2K3-SBS with a FQDN parameter of server2k3-sbs.DOMAIN.internal. If the connector's FQDN is not specified, the computer's FQDN is used. Verify the connector configuration and the installed certificates to make sure that there is a certificate with a domain name for that FQDN. If this certificate exists, run Enable-ExchangeCertificate -Services SMTP to make sure that the Microsoft Exchange Transport service has access to the certificate key.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.





Event Type: Warning
Event Source: MSExchangeTransport
Event Category: TransportService
Event ID: 12015
Date: 16/02/2009
Time: 09:18:53
User: N/A
Computer: SERVER2K3-SBS
Description:
An internal transport certificate expired. Thumbprint:C7635A3F281FD2CB8E046A19D19************

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


It would appear that Microsoft have now put in place a 1 year certificate expiration for Exchange 2007, meaning that quite simply every year users will see this message until you manually recreate the certificate. The way around this is to obviously purchase a certificate from a higher authority but not everyone wants to pay out on something they see no sense in having.

to rebuild this certificate simply go into Exchange Management Shell and then type:
"New-ExchangeCertificate" followed by "Y" to confirm.



More resources and info on this can be found in the following links:
New Exchange Cmdlet

Certificate Use in Exchange 2007

Exchange 2003 to 2007 Migration (Exmerge)

Just some little handy tips to share around in regards to migrating users from a Microsoft Exchange 2003 server to the all new singing and dancing Exchange 2007.

As most of you will probably know just from looking at the new Exchange management console it isnt quite as easy as copying and pasting the priv1.edb or Exmerging in and Exmerging out the old data.

The techniques are now slightly different:

Although the method is the same there is a slight change if you are doing this for a Server 2003 with Exchange 2007 or an SBS 2008 with Exchange 2007. If you are runnning SBS 2008 then you must download the Exchange Management Tools and the Windows Powershell add-on from the Microsoft site and run this on a 32-Bit machine seperate to the SBS box. (Please note that if you are doing import mailbox procedures then you need to download Exchange 2007 SP1 from the site)

So first step then is the data extraction; from 2003 this is very basic and straight forward using Exmerge from Microsoft you can take out all of the previous mailboxes into PST's and store them on the new server.

The second step is to go into the Exchange management shell and enter the following commands bearing in mind that all scripts are case sensitive.

Grant the Administrator Account full access to all Mailbox's:
"Get-Mailbox | Add-MailboxPermission –user Username –AccessRight FullAccess –Inheritancetype all"

Begin the import procedure for all users
"Get-Mailbox -Database “SERVER\Mailbox Database” | Import-Mailbox -PSTFolderPath "

This will then go through the motions for importing all of the pst files into their correct user accounts.

If you want to look at importing an individual mailbox to an individual user then the process is again very similar but the command is as follows:
"Import-Mailbox -Identity -PSTFolderPath "




TIP:
Typing -whatif at the end of a command in Exchange powershell runs a simulation of the command without actually doing anything with the data.



Did I solve your problem? Buy me a virtual beer by clicking on a Google ad :). Thanks!