Exchange Server2013 系列十：证书的配置

冷不防 2022-04-03 03:30 286阅读 0赞

杜飞

经过前面的配置，基本上可以进行简单的邮件通讯了，但是当用户通过OWA连接邮箱时会报下面的提示：

[![image][]][image 1]

其他一些服务，如 Outlook Anywhere 和 Exchange ActiveSync，也要求在 Exchange 2013 服务器上配置证书。下面咱们就看一下证书的配置：

**首先，我们需要安装内部CA**。在此，我就在DC01上安装CA。

选择 AD证书服务，如下图所示：

[![image][image 2]][image_image 2]

然后，连续下一步之后，选中下图所示的证书颁发机构和证书颁发机构WEB注册。

[![image][image 3]][image_image 3]

稍等片刻之后，等证书颁发机构安装成功。接下来，还需要进行证书服务配置。

[![image][image 4]][image_image 4]

下一步之后，出现下图所示的界面：

[![image][image 5]][image_image 5]

[![image][image 6]][image_image 6][![image][image 7]][image_image 7]

选择企业CA----根CA。基本选项基本默认即可。

**再次，为Exchange CAS角色申请证书：**

登录到EAC----服务器----证书，确保在“选择服务器”字段中选择了客户端访问服务器，然后单击“新建”![添加图标][IC607831.gif]。

[![image][image 8]][image_image 8]

在“新建 Exchange 证书”向导中，选择“创建从证书颁发机构获取证书的请求”，然后单击“下一步”。

[![image][image 9]][image_image 9]

指定此证书的名称，然后单击“下一步”。

[![image][image 10]][image_image 10]

不想申请通配符证书，则将该页留空。单击“下一步”。

[![image][image 11]][image_image 11]

单击“浏览”，指定用于存储证书的 Exchange 服务器。您选择的服务器应是面向 Internet 的客户端访问服务器。单击“下一步”。

[![image][image 12]][image_image 12]

对于列表中显示的每个服务，验证用户将用来连接到 Exchange 服务器的外部或内部服务器名称是否正确。

[![image][image 13]][image_image 13]

添加您要在 SSL 证书中包括的其他任何域，例如本例中加入了一系列和dudangdang.com以及CAS02相关的域名。

[![image][image 14]][image_image 14]

同时选择一个做为公用域名：

[![image][image 15]][image_image 15]

填写基本信息。

[![image][image 16]][image_image 16]

将证书请求保存到共享文件夹中：

[![image][image 17]][image_image 17]

然后，浏览器访问 [http://10.41.4.210/certsrv(CA][http_10.41.4.210_certsrv_CA])，选择申请证书---高级证书申请---使用BASE64编码的证书申请，出现下图，提交[![image][image 18]][image_image 18]

提交之后，出现下图所示的界面：

[![image][image 19]][image_image 19]

选择：下载证书。保存到指定的位置，如C:\\。

然后，完成搁置的请求，点击“完成”，如下图所示：

[![image][image 20]][image_image 20]

指定刚才下载的证书文件：

[![image][image 21]][image_image 21]

然后，就可以看到此证书已经变为有效了（如果还是无效，则需要导入CA证书），然后选中此证书，编辑

[![image][image 22]][image_image 22]

接下来分配服务：在证书页面上，单击“服务”。选择您要分配给此证书的服务。至少，您应选择“SMTP”和“IIS”。单击“保存”。如果收到警告“是否覆盖现有的默认 SMTP 证书?”，单击“是”。

[![image][image 23]][image_image 23]

因为，我们有两个CAS服务器，因此，我们需要将CAS01上刚刚申请的证书导出，然后在CAS02上导入。如下图所示：

[![image][image 24]][image_image 24]

指定指定导出文件的路径文件名以及保护密码：在此直接保存到CAS02上。

[![image][image 25]][image_image 25]

然后，切换到DF-CAS02上，导入证书：

[![image][image 26]][image_image 26]

然后，指定刚才pfx文件的共享路径及密码：

[![image][image 27]][image_image 27]

然后，选择应用此证书的服务器：

[![image][image 28]][image_image 28]

然后，此服务器上也需要为证书分配服务，方法同上。

验证方法也非常简单，再次访问OWA，如果不出现本文档开头的警告信息就OK了。

[image]: http://dufei.blog.51cto.com/attachment/201407/9/382644_14049074758YOf.png
[image 1]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907474NO2j.png
[image 2]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907475woHM.png
[image_image 2]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907475P289.png
[image 3]: http://dufei.blog.51cto.com/attachment/201407/9/382644_14049074755tgD.png
[image_image 3]: http://dufei.blog.51cto.com/attachment/201407/9/382644_14049074759YSg.png
[image 4]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907475X1zF.png
[image_image 4]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907475Ha9E.png
[image 5]: http://dufei.blog.51cto.com/attachment/201407/9/382644_14049074750cAn.png
[image_image 5]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907475JqlG.png
[image 6]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907475EXM9.png
[image_image 6]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907475wDAQ.png
[image 7]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907475SlEP.png
[image_image 7]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907475EEa7.png
[IC607831.gif]: http://i.technet.microsoft.com/dynimg/IC607831.gif
[image 8]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907475MMwq.png
[image_image 8]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907475NcW6.png
[image 9]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476DRic.png
[image_image 9]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907475y9Vu.png
[image 10]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476Ur8X.png
[image_image 10]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476WXEJ.png
[image 11]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476XLj0.png
[image_image 11]: http://dufei.blog.51cto.com/attachment/201407/9/382644_14049074760QEk.png
[image 12]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476WhVF.png
[image_image 12]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476jp61.png
[image 13]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476Dury.png
[image_image 13]: http://dufei.blog.51cto.com/attachment/201407/9/382644_14049074765cuJ.png
[image 14]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476aqQz.png
[image_image 14]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476qqIx.png
[image 15]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476ktym.png
[image_image 15]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476jG1s.png
[image 16]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476s28G.png
[image_image 16]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476RzWH.png
[image 17]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476yKB2.png
[image_image 17]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476l1VI.png
[http_10.41.4.210_certsrv_CA]: http://10.41.4.210/certsrv%28CA
[image 18]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907477OJCt.png
[image_image 18]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907476UvWf.png
[image 19]: http://dufei.blog.51cto.com/attachment/201407/9/382644_14049074770Eb1.png
[image_image 19]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907477QOYW.png
[image 20]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907477asYj.png
[image_image 20]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907477rVgi.png
[image 21]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907477yw7B.png
[image_image 21]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907477P31u.png
[image 22]: http://dufei.blog.51cto.com/attachment/201407/9/382644_14049074777URL.png
[image_image 22]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907477rcAE.png
[image 23]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907477X74g.png
[image_image 23]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907477wUCa.png
[image 24]: http://dufei.blog.51cto.com/attachment/201407/9/382644_14049074779Kkb.png
[image_image 24]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907477iLbb.png
[image 25]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907541jzYb.png
[image_image 25]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907541dDXt.png
[image 26]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907541PMxr.png
[image_image 26]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907541pMMw.png
[image 27]: http://dufei.blog.51cto.com/attachment/201407/9/382644_14049075413ttu.png
[image_image 27]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907541BHKe.png
[image 28]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907541EZAf.png
[image_image 28]: http://dufei.blog.51cto.com/attachment/201407/9/382644_1404907541eba1.png