Exchange 2013 UM Certificate

After spending some time this morning trying to deploy a new certificate for Exchange UM in a Exchange 2013 server, I figured I would do this quick post so that I don't have to go looking next time around.

To create the new certificate request from the exchange management shell:

$certReq = new-exchangecertificate -subjectName "C=AU,S=NSW,L=My UC Thoughts,O=City, OU=IT,CN=E2K13.myucthoughts.local" -domainName E2K13.myucthoughts.local -privatekeyexportable $true -generaterequest

set-content -path "c:\certificates\UM.req" -value $certReq

From here you can then complete request from the Certificate Authority to approve the certificate using the UM.req file.  Once you have the certificate you can "complete" the pending certificate request from the Exchange 2013 server.

Update 28/08/2015:
Found this site today that has a web form and it will generate the "New-ExchangeCertificate" command for you to copy and paste.

http://www.tachytelic.net/2010/03/new-exchangecertificate-cmdlet-syntax-generator/

TLS Schannel Errors

Had an issue the other day and it took me awhile to find out what the TLS Schannel error codes meant.

The exact error message I was receiving was:

After doing some "googling" I was able to find a nice list of the Schannel error message:

Error Code	Description
0	CLOSE NOTIFY
10	UNEXPECTED MESSAGE
20	BAD RECORD MAC
21	DECRYPTION FAILED
22	RECORD OVERFLOW
30	DECOMPRESSION FAIL
40	HANDSHAKE FAILURE
42	BAD CERTIFICATE
43	UNSUPPORTED CERT
44	CERTIFICATE REVOKED
45	CERTIFICATE EXPIRED
46	CERTIFICATE UNKNOWN
47	ILLEGAL PARAMETER
48	UNKNOWN CA
49	ACCESS DENIED
50	DECODE ERROR
51	DECRYPT ERROR
60	EXPORT RESTRICTION
70	PROTOCOL VERSION
71	INSUFFIENT SECURITY
80	INTERNAL ERROR
90	USER CANCELED
100	NO RENEGOTIATION
110	UNSUPPORTED EXT

From the error message i was receiving in the Windows System Event Viewer we can see that the error code was/is "42" which relates to a "BAD CERTIFICATE"

From here I re-generated the certificate on the Lync gateway, and restarted the Lync SBA that was associated with the trunk and the Schannel error and related mediation Server errors cleared.

Reference Link:
http://msdn.microsoft.com/en-us/library/windows/desktop/dd721886(v=vs.85).aspx

Certificate Requests "Denied by Policy"

So I have been having some issues with generating certificates for SBC's for a customer, was getting the following error message:

The only way that I have been able to get the certificate issued is by using the cerreq.exe command.

First I had to launch Command Prompt "Run as Administrator"

From the command line run the following command:

certreq -attrib "CertificateTemplate:WebServer"

You will then be prompted to locate the CSR, the CA will process the request, you will be prompted for a location to save the newly assigned certificate.

And be left with something like this in the command prompt window:

You will then have a new certificate that you can use as required..