Designing a simple namespace for Exchange 2010

One of the frequent questions I receive concerns namespace design. I had previously covered this in my series Migrating Exchange from 2003 to 2010. However, with the recent restrictions on SSL certificates, I felt it necessary to revisit this topic with a dedicated article.

So, let’s get started!

What’s in a name

Namespace is very important.

Not only does namespace govern services like Outlook Web App, or, ActiveSync, but it also governs items such as the distribution of the Offline Address Book, or, the Autodiscover service.

A correct namespace design is key.

Out of the box, Exchange configures its internal URLs to match its internal hostname.

Due to recent restrictions, 3rd-party certificate providers can no longer put internal hostnames on certificates. This is actually a good thing! Otherwise, you are exposing the internal names of your servers to the internet.

However, if our certificate does not match our internal hostname it will give our users a security warning.

“So how do we combat this?”

Simple. In Exchange, we copy and paste our external URLs over our internal URLs. That way there is no certificate mismatch.

Then we use split-brain DNS to resolve those newly pasted addresses to the internal IP of our CAS server.

Split-brain keeps all the traffic on the local LAN. Without it, all local traffic would try to go out the firewall only to try and come back in later. Most firewalls will block this kind of behavior.

Reconfigure those URLs

Okay, let’s change those Internal URLs.

1. Open the Exchange Management Console.
2. Expand Microsoft Exchange On-Premises (server name)
3. Expand Server Configuration
4. Select Client Access
5. In the lower-right pane, under the Outlook Web App tab, double-click OWA (Default Web Site).
6. Under the General tab, copy the contents of the External URL and paste over the content in the Internal URL field.
   

   

7. Click Ok.
8. Repeat steps 6 and 7 for the Exchange Control Panel, Exchange ActiveSync, and Offline Address Book Distribution tabs.

We also need to make changes to two additional namespaces. Autodiscover and Exchange Web Services (EWS). These are not in the GUI. For this open the Exchange Management Shell and issue the following commands.

Note: Be sure to change EXCHANGE on both these commands to the hostname of your internal server.

 C:\> Set-WebServicesVirtualDirectory -Identity “EXCHANGE\EWS (Default Web Site)” -InternalUrl https://mail.daleksofskaro.com/EWS/Exchange.asmx -BasicAuthentication:$true

To confirm the change.

 C:\> Get-WebServicesVirtualDirectory | fl identity,internalurl,ExternalURL

And now for Autodiscover.

 C:\> Set-ClientAccessServer -Identity EXCHANGE –AutoDiscoverServiceInternalUri https://autodiscover.daleksofskaro.com/Autodiscover/Autodiscover.xml

To confirm this change.

 C:\> Get-ClientAccessServer |fl identity,autodiscoverserviceinternaluri

Split-Brain DNS

Alright, let’s get our split-brain DNS configured next. Our DNS Servers will hold non-authoritative zones for our external namespace. This will only be used by our internal users.

1. On your DNS server open DNS Manager.
2. Right-click on Forward Lookup Zone and select New Zone… from the context menu.
   

   

3. Click Next.
4. Keep all the default settings. Click Next.
   

   

5. Keep all the default settings. Click Next.
   

   

6. In the Zone Name field enter your public domain name (in our example daleksofskaro.com).
   

   

7. Keep all the default settings. Click Next.
   

   

8. Click Finish.
9. Expand Forward Lookup Zones.
10. In the left pane, right-click on daleksofskaro.com zone and select New Host (A or AAAA) from the context menu.
    

    

11. In the Name field type the first name on your certificate. In the IP address field type the internal IP of your Client Access Server. (In our example it is 10.15.1.49).
12. Click Add Host
    

    

13. Repeat Steps 10-12 for all other names on your certificate.
14. The end result should look similar to this.
    

    

Note: You will also need to repeat Steps 10-12 for any resources you have on the Internet. For example, if your website is www.daleksofskaro.com, you will need to create a www host A record and point it to the public IP address of your hosting provider.

Certificate Requirements

Now let’s get our certificate generated for our new namespace.

One of the greatest improvements in Exchange 2010 was including a brand new Certificate Generation Request wizard in the EMC.

This wizard takes all the guesswork out of what kind of certificate you will need to purchase.

Let’s get started.

1. Open the Exchange Management Console.
2. Expand Microsoft Exchange On-Premises (server name)
3. Select Server Configuration
4. In the far-right Action pane, click the link for New Certificate Request…
5. In the Enter a friendly name field, enter your certificate name. In our example, we will make this mail.daleksofskaro.com. Click Next.
   

   

6. Do NOT check wildcard. Leave this unchecked and click Next.
7. This next page will help us determine all the namespaces we need on our new certificate.
8. Expand Client Access Server (Outlook Web App).
   1. Check Outlook Web App is on the intranet.
   2. Check Outlook Web App is on the internet.
   3. Make sure our external URL is the only address in both Domain name fields. In our case mail.daleksofskaro.com.
      

      

9. Expand Client Access Server (Exchange ActiveSync).
   1. Check Exchange Active Sync is enabled.
   2. Make sure our external URL is the only address in the Domain name field. In our case mail.daleksofskaro.com.
10. Expand Client Access Server (Web Services, Outlook Anywhere, and Autodiscover):
    1. Check Exchange Web Services is enabled.
    2. Check Outlook Anywhere is enabled.
    3. Make sure our external URL is the only address in the External hostname field. In our case mail.daleksofskaro.com.
    4. Check Autodiscover used on the Internet
    5. Check Long URL (Example: autodiscover.contoso.com)
    6. Make sure our autodiscover URL is the only address in the Autodiscover URL to use field. In our case autodiscover.daleksofskaro.com.
       

       

11. Click Next.
12. The next screen should list all names you just created in DNS. If not, you can also add them here. In our example, we also made sure mail.daleksofskaro.com was Set as the common name (in bold).
    

    

13. Click Next
14. Fill out your Organization and Location information.
15. Click the Browse button and save the Certificate Request file to the Desktop.
    

    

16. Click Next
17. Click New
18. Before you click Finish, review the three steps. You will notice in Step 1, it has identified you need a UC certificate. This is also known as a SAN certificate. Click Finish.
    

    

This should have created a certificate request file on your desktop. Open this file with Notepad and copy the entire contents, including the BEGIN and END lines.

Now you will need to purchase a UC / SAN certificate from a 3rd party source. There are many out there. I highly recommend Digicert.com (affiliate). Once the certificate has been processed and you have downloaded and unpacked your ZIP file we need to complete the certificate request.

1. In the lower-right pane, right-click on the name of our certificate (mail.daleksofskaro.com) and select Complete Pending Request from the context menu.
   

   

2. Click the Browse button and locate the certificate from DigiCert (affiliate).

   

3. Click Complete.

Exchange Web Services are still assigned to your old certificate. Let’s get these switched over to the new certificate.

1. In the lower-right pane, right-click on the name of our certificate (mail.daleksofskaro.com) and select Assign Services to Certificate from the context menu.
2. Select Internet Information Service (IIS).
   

   

3. Click Assign
4. Click Finish

Now that we have our new certificate installed, we need to test to make sure it is working properly.

The easiest way to check is to enter your external URL (https://mail.daleksofskaro.com/owa) into a web browser.

Test from both an internal and an external source.

Make sure there are no certificate errors.

Tip: I recommend testing with the Microsoft Remote Connectivity Analyzer. https://testconnectivity.microsoft.com/

Test results all good? Then you are all done!

Was this article helpful to you? Leave us a comment and let us know how we are doing.