Hi, Designing the necessary certificates for Exchange Server 2010 depends on a number of factors like: DNS-configuration (spit-brain or not) Co-location of server-roles High availability (i.e. CAS arrays and/or NLB) Wether a local PKI-infrastructure are in place Does anybody know of a complete overview of the certificate requirements for all scenarios for certificate requirements in Exchange Server 2010? I.e. a blog-post or any official Microsoft documentation.

Before i answer your questions, i have some for you! Is it DAG environment? What do you mean by co-location? Gulab | Skype: gulab.mallah

Before i answer your questions, i have some for you! Is it DAG environment? What do you mean by co-location? Gulab | Skype: gulab.mallah

Is it DAG environment? Yes. Would the fact that it`s a DAG environment change the certificate requirements? What do you mean by co-location? Server-roles installed on the same computer, i.e. both CAS and Hub Transport roles on the same computers.

I am hope it helps, http://technet.microsoft.com/en-us/library/aa998840.aspx http://exchangeserverpro.com/exchange-2010-ssl-certificates Mainly cert's are required on the CAS server DNS-configuration (spit-brain or not) (Not required) Co-location of server-roles (Required on CAS server Internal and External for OWA, Active Sync and Outlook Anywhere) High availability (i.e. CAS arrays and/or NLB) (Internal and External for OWA, Active Sync and Outlook Anywhere) Wether a local PKI-infrastructure are in place (It will require a Cert, recommended is VeriSign) Looking for some more information, will let you ASAP Let me know if you have any question on above? Gulab | Skype: gulab.mallah

I am hope it helps, http://technet.microsoft.com/en-us/library/aa998840.aspx http://exchangeserverpro.com/exchange-2010-ssl-certificates Mainly cert's are required on the CAS server DNS-configuration (spit-brain or not) (Not required) Co-location of server-roles (Required on CAS server Internal and External for OWA, Active Sync and Outlook Anywhere) High availability (i.e. CAS arrays and/or NLB) (Internal and External for OWA, Active Sync and Outlook Anywhere) Wether a local PKI-infrastructure are in place (It will require a Cert, recommended is VeriSign) Looking for some more information, will let you ASAP Let me know if you have any question on above? Gulab | Skype: gulab.mallah

Not sure that I agree with Gulab's response, espesially the VeriSign comment (:-)), but in short you require certificates for all your https services including Autodiscover, Outlook Anywhere, Webmail and ActiveSync. I recommend you check out the Exchange deployment assistant first as certificates must fit into your namespace planning, it is not really something you should plan seperatly. http://technet.microsoft.com/en-us/exdeploy2010/default.aspx#Index Casper Pieterse, Principle Consultant - UC, Dimension Data South Africa, Microsoft Certified Master: Exchange 2007

Thats what i meant, all the services like Autodiscover, Outlook Anywhere, Webmail and ActiveSync requires SSL. I mentioned VeriSign as a vendor nothing much ;)Gulab | Skype: gulab.mallah