Hybrid Deployment and Wild Card certificate

[Teka Teka]

Hi All,

i have a hybrid deployment with Exchange 2013, can i use a wild card certificate with the hybrid server for the autodiscover and hybrid records?

[#2]

Hi Teka,

Yes, you can use it for all Hybrid deployment.

[#3]

Thanks for the reply,

so i will import it as *.mydomain.com and that's it? athen i point autodiscover and hybrid DNS records to it?

[#4]

Yes, that's it.

[#5]

Thanks for your support.

[#6]

Hi

do i need to install the new certificate in all servers or only the hybrid server and keep the old certificate on the other servers.

[#7]

For best experience and to keep the configuration simple, you should install the same certificate across all Exchange Infrastructure.

[#8]

and what will happen if i used 2 certificates 1 for the hybrid server and another one for other servers?

[#9]

Hi Teka,

You can read more at the article as it mention "Use as few certificates as possible"

https://technet.microsoft.com/en-us/library/dd351044(v=exchg.160).aspx#BestPractices

You can use more than one certificate but be is advised to use a few or just the Wildcard with SAN's, but it always depend on the third party CA.

[#10]

Thanks Silva for your support

[#11]

@Nuno Silva - We are using a wildcard certificate on our Exchange 2019 Hybrid server.  All mailboxes are in the cloud.  The certificate is only assigned IIS and SMTP.  There is only one on-prem mailbox in this server. We renewed the wildcard certificate from the same company and the same domain information.  Exchange server says the certificate is valid after I imported it. Do I still need to re-run the Hybrid Configuration? I prefer not to rerun if not needed. I read somewhere that I don't need to re-run if the names have not changed. Do you know if this is true or we should always rerun the Hybrid configuration? Thank you. 

[#12]

Hi @Dobongsoon,

Is advised to run Hybrid Configuration Wizard to update the certificate regarding that could have some changes and Hybrid Configuration Wizard will do the update of that configurations.

Best Regards,
Nuno Árias Silva
MVP Office Apps and Services
https://www.nuno-silva.net
 

[#13]

Hi @Nuno Silva

Have got an interesting question about HCW requirements.

If the network scenario requires me to publish Ex 2016 mailbox server using hybrid.exoip.com for EWS and smtp.exoip.com for SMTP separately using 2 public IPs one for each service and I just have one SAN certificate covering both EWS and SMTP FQDNs. Which URL should I point HCW to while deploying classic full?

My guess is to run it pointing to EWS URL hybrid.exoip.com only and once connectors are created, manually switch the FQDN from hyrbid.exoip.com to smtp.exoip.com on the new connectors listed below.

Exch: SendConnector -Name ‘Outbound to Office 365’ and
EXO: OutboundConnector -Name ‘Outbound to 48e7bec9-404c-4d24-b59e-4b46b64d7e03’

Thanks in advance.