Designing a simple namespace for Exchange 2013

One of the most frequent questions I receive concerns namespace design.

I covered this recently in an article geared towards Exchange 2010. However, it quickly became apparent I needed to revisit this topic specifically for Exchange 2013. Especially with the big GUI rewrite.

So, let’s get started!

What’s in a namespace

Namespace is very important.

Not only does namespace govern services like Outlook Web App, or, ActiveSync, but it also governs items such as the distribution of the Offline Address Book, or, the Autodiscover service.

A correct namespace design is key.

Out of the box, Exchange configures its internal URLs to match its internal hostname.

Due to recent restrictions, 3rd-party certificate providers can no longer put internal hostnames on certificates. This is actually a good thing! Otherwise, you are exposing the internal names of your servers to the internet.

However, if our certificate does not match our internal hostname it will give our users a security warning.

“So how do we combat this?”

Simple. In Exchange, we copy and paste our external URLs over our internal URLs. That way there is no certificate mismatch.

Then we use split-brain DNS to resolve those newly pasted addresses to the internal IP of our CAS server (or load balancer).

Split-brain keeps all the traffic on the local LAN. Without it, all local traffic would try to go out the firewall only to try and come back in later. Most firewalls will block this kind of behavior.

Reconfigure those URLs

Okay, let’s change those Internal URLs.

1. Log into the Exchange Admin Center.
2. Select the Servers tab.
3. Select the Virtual Directories tab.

   

4. In the Select Server drop-down box, pick the server you wish to modify.
   

   

5. Double-click to open the ECP (Default Web Site) properties.
6. Copy the contents of the External URL and paste over the contents of the Internal URL.
   

   

7. Click Save.
8. Repeat steps 5 through 7 for:
   • EWS (Default Web Site).
   • Microsoft-Server-ActiveSync (Default Web Site).
   • OAB (Default Web Site).
   • OWA (Default Web Site).
   • PowerShell (Default Web Site).

We also need to modify the Outlook Anywhere URLs.

1. Select the Servers sub-tab.
   

   

2. Double-click the server you wish to change.
3. Select the Outlook Anywhere tab.
4. Copy the contents of the External Host Name field and paste over the contents of the Internal Host Name field.
5. Click Save.

We also need to make a change to one additional namespace; Autodiscover. This is not in the GUI. For this open the Exchange Management Shell and issue the following commands.

Note: Be sure to change EX2013 on this command to the hostname of your internal server.

 C:\> Set-ClientAccessServer -Identity EX2013 –AutoDiscoverServiceInternalUri https://autodiscover.daleksofskaro.com/Autodiscover/Autodiscover.xml

To confirm this change.

 C:\> Get-ClientAccessServer |fl identity,autodiscoverserviceinternaluri

Split-Brain DNS

Alright, let’s get our split-brain DNS configured next. Our DNS Servers will hold non-authoritative zones for our external namespace. This will only be used by our internal users.

1. On your DNS server open DNS Manager.
2. Right-click on Forward Lookup Zone and select New Zone… from the context menu.
   

   

3. Click Next.
4. Keep all the default settings. Click Next.
   

   

5. Keep all the default settings. Click Next.
   

   

6. In the Zone Name field enter your public domain name (in our example daleksofskaro.com).
   

   

7. Keep all the default settings. Click Next.
   

   

8. Click Finish.
9. Expand Forward Lookup Zones.
10. In the left pane, right-click on daleksofskaro.com zone and select New Host (A or AAAA) from the context menu.
    

    

11. In the Name field type the first name on your certificate. In the IP address field type the internal IP of your Client Access Server. (In our example it is 10.15.1.49).
12. Click Add Host
    

    

13. Repeat Steps 10-12 for all other names on your certificate.
14. The end result should look similar to this.
    

    

Note: You will also need to repeat Steps 10-12 for any resources you have on the Internet. For example, if your website is www.daleksofskaro.com, you will need to create a www host A record and point it to the public IP address of your hosting provider.

Certificate Requirements

Now let’s get our certificate generated for our new namespace.

Like its predecessor, Exchange 2013 maintains the Certificate Request Wizard. Unlike, 2010, I believe this wizard has been greatly simplified.

This wizard takes all the guesswork out of what kind of certificate you will need to purchase.

Let’s get started.

1. Open the Exchange Admin Center.
2. Select the Servers tab.
3. Select the Certificates tab.
4. Click the + (New) button.
   

   

5. In the New Exchange Certificate wizard select Create a request for a certificate from a certification authority. Click Next.
   

   

6. In the Enter a friendly name field, enter your certificate name. In our example, we made this mail.daleksofskaro.com. Click Next.
   

   

7. Do NOT check wildcard. Leave this unchecked. Click Next.
   

   

8. Click Browse.
9. Select the server you wish to store this request on. Click Ok.
10. Click Next.
    

    

11. The next screen allows you to manually change any domain names you want on your certificate. I normally skip past this and make my edits on the next screen. Click Next.
    

    

12. Select the Add, Edit or Remove buttons to make any final tweaks to the names you require on your Exchange certificate. With our previous modifications of all the Internal URLs, this should be minimal. In our example, we had to remove the root local domain. You can also confirm which name is Set as the common name. (In our example this is mail.daleksofskaro.com.)
13. When done, click Next.
    

    

14. Complete all organization information. Click Next.
    

    

15. Specify a UNC path to where you want to save the certificate request file. In our example, we saved this to our desktop.
    

    

16. Click Finish.

This should have created a certificate request file on your desktop. Open this file with Notepad and copy the entire contents, including the BEGIN and END lines.

Now you will need to purchase a UC / SAN certificate from a 3rd party source. There are many out there. I highly recommend Digicert.com (affiliate). Once the certificate has been processed and you have downloaded and unpacked your cert file we need to complete the certificate request.

1. While still on the Certificates tab, select your pending certificate request and click the Complete link from the action pane.
   

   

2. In the Complete Request window, type the UNC path to the location of the unpacked Digicert (affiliate) certificate.
   

   

3. Click Ok.
4. Once the task completes the certificate will be listed as Valid in both the Status column and in the Status section in the action pane.

Exchange Web Services are still assigned to your old certificate. Let’s get these switched over to the new certificate.

1. While still on the Certificates tab, select your newly added certificate and click the Edit button.
2. Select the Services tab.
3. Select IIS (and any additional services you need).
   

   

4. Click Save.

Now that we have our new certificate installed, we need to test to make sure it is working properly.

The easiest way to check is to enter your external URL (https://mail.daleksofskaro.com/owa) into a web browser.

Test from both an internal and an external source.

Make sure there are no certificate errors.

Note: I recommend testing with the Microsoft Remote Connectivity Analyzer. https://testconnectivity.microsoft.com/

Test results all good? Then you are all done!

Did this post help you? Let us know how we are doing by leaving us a comment. Your feedback is always important to us!