Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. Clients include mobile phones, computers inside an organization's network, and computers outside an organization's network. SSL requires you to use digital certificates. This topic summarizes the different types of digital certificates and information about how to configure Exchange to use these types of digital certificates.

Digital certificates are electronic files that work like an online password to microsoft outlook 2013 cannot publish your certificates free the identity of a user or a computer. They're used to create the Microsoft outlook 2013 cannot publish your certificates free encrypted channel that's used for client communications. A certificate is a digital statement that's issued by a certification authority CA that vouches for the identity of the certificate holder and enables the parties to communicate in a secure manner using encryption.

They authenticate that their holders people, websites, and even network resources such as microsoft outlook 2013 cannot publish your certificates free are truly who or what they claim to be.

Digital certificates can be issued by a trusted third-party CA or a Windows public key infrastructure PKI using Certificate Services, or they can be self-signed. Each type of certificate has advantages and disadvantages. Each type of digital certificate is tamper-proof and can't be forged.

Certificates can be issued for several uses. A certificate contains a public key and microsoft outlook 2013 cannot publish your certificates free that public key ouhlook the identity of a person, computer, or service that holds the corresponding private key. The public and private keys are used by the client and the server to encrypt the microsoft outlook 2013 cannot publish your certificates free before it's transmitted.

For Windows-based users, computers, and services, trust in a CA is established when there's a copy of the root certificate in the trusted root certificate store and the certificate contains a valid certification path. For the certificate to be valid, the certificate must not have been revoked and the microsoft outlook 2013 cannot publish your certificates free period must not have expired.

There are three primary types of digital certificates: self-signed certificates, Windows PKI-generated certificates, and third-party certificates. When you install Exchangea self-signed certificate is automatically configured on the Mailbox servers.

A self-signed certificate is signed by the application that created it. The subject and the name of the certificatea match. The issuer and the subject are defined on the certificate. This self-signed certificate is used to encrypt communications between the Client Access server and the Mailbox cedtificates.

The Client Access server trusts the self-signed certificate on the Mailbox server automatically, so no third-party certificate is needed on cerfificates Mailbox server. When you install Exchangea self-signed certificate is also created on the Client Access server. This self-signed certificate will allow some client protocols to use SSL for their communications.

Outlook Anywhere won't work with a self-signed certificate on the Client Access server. Self-signed certificates must be manually copied to the trusted root certificate store on the client computer or mobile device. When a client connects to a server over SSL and the server presents a self-signed certificate, the client will be prompted to verify that the certificate was issued by a trusted authority.

The client must explicitly trust the issuing authority. If the client confirms the trust, then SSL communications can continue. By default, the digital certificate installed on the Mailbox server or servers is a self-signed certificate. You don't need to replace the self-signed certificate on the Mailbox servers in your organization with a trusted third-party certificate.

The Client Access server automatically trusts the self-signed certificate on the Mailbox server and no other configuration is needed for certificates on the Mailbox server. Frequently, small organizations decide not to use a third-party certificate or not to install their own PKI to issue their own certificates. They might make this decision because those solutions are too expensive, because micrpsoft administrators microsoft outlook 2013 cannot publish your certificates free the experience and knowledge to create their own certificate hierarchy, or for both reasons.

The cost is minimal and the setup is simple when you use self-signed certificates. Microsoft outlook 2013 cannot publish your certificates free, it's much more difficult to establish an infrastructure for certificate life-cycle management, renewal, trust management, and revocation when you use self-signed certificates.

The second type of certificate is a Windows PKI-generated certificate. A PKI is a microsoft outlook 2013 cannot publish your certificates free of digital certificates, certification authorities, and registration authorities RAs that verify and authenticate the validity of each mkcrosoft that's involved in an electronic transaction by using public key cryptography.

When you certificcates a PKI in an organization that uses Active Directory, you provide an infrastructure for certificate life-cycle management, renewal, trust management, and revocation. However, there is some additional cost involved in deploying servers and infrastructure to create and manage Windows PKI-generated certificates. You can install Certificate Services on any server in the domain.

If you obtain certificates from a domain-joined Windows CA, you can use the CA to request or sign certificates to issue to your own servers or computers on your network. This enables you to use a PKI that resembles a third-party certificate vendor, but is less expensive.

These PKI certificates can't be deployed publicly, as other types of certificates can be. However, when a PKI CA signs the requestor's certificate by using the private key, the requestor is verified. The public key of this CA is part of the certificate. A server that has this certificate in the trusted root certificate store can use that public key to decrypt the requestor's certificate and authenticate the requestor.

The steps for deploying a PKI-generated certificate resemble those required for deploying a self-signed certificate. You must still install a copy of the trusted root certificate from the PKI oytlook the trusted root certificate store of the computers or mobile devices that you want to be able to establish an SSL connection to Microsoft Exchange.

A Windows PKI enables organizations to publish their own certificates. Clients can request and receive certificates from a Windows PKI on the internal network.

The Certificatse PKI can renew or revoke certificates. Third-party or commercial certificates are certificates that are generated by a third-party or commercial CA and then purchased for you to use on your network servers.

One problem with self-signed and PKI-based certificates is that, because the certificate is not automatically trusted by the client computer or mobile device, you must make sure that you import the certificate into the publis root certificate store on client computers and devices.

Third-party or commercial certificates do not have this problem. Most commercial CA certificates are already trusted because the certificate already resides in the trusted root certificate store. Because the microsoft outlook 2013 cannot publish your certificates free is trusted, the certificate is also trusted. Using third-party certificates greatly simplifies deployment. For larger organizations or organizations that must publicly deploy certificates, the best solution is to use a third-party or commercial certificate, even though there is a cost associated with the certificate.

Commercial certificates may not be the microsovt solution for small and medium-size organizations, and you might decide to use one of the other certificate options that are available.

When you choose the type of certificate to install, there are several things to consider. A certificate must be signed to be valid.

It can be self-signed or signed by a CA. A self-signed certificate has limitations. For example, not all mobile devices let a user install a digital certificate in the trusted root certificate store.

The ability to install certificates on a mobile device depends microsoft outlook 2013 cannot publish your certificates free the mobile device manufacturer and the mobile service provider. Some manufacturers and mobile service providers disable access to the trusted root certificate store. In this case, neither a self-signed certificate nor a certificate from certificaes Windows PKI CA can be installed on the mobile device.

By default, Exchange installs a self-signed certificate on both the Client Access server and the Mailbox server so that all network communication is encrypted.

Encrypting all network communication requires that every Exchange server have an X. You should replace this self-signed certificate on the Client Access server with one that is automatically trusted by microsoft outlook 2013 cannot publish your certificates free clients.

Because it wasn't created and signed by a generally trusted CA, the default self-signed certificate won't be trusted by any software except other Exchange servers in the same organization. The default certificate is enabled for all Exchange services. It has a subject alternative name SAN that corresponds to the server name of the Exchange server that it's installed on.

Although other Exchange servers in your Exchange organization trust this certificate automatically, clients like web browsers, Outlook clients, mobile phones, and other email clients in addition to external email servers won't automatically trust it.

Therefore, consider replacing this certificate with a trusted certificqtes certificate on your Exchange Client Access servers. If you have your own internal PKI, and all your clients trust that entity, you can also use certificates that you issue yourself. Certificates are used for several things in Exchange. Most customers also use certificates on more than one Exchange server. In general, the fewer certificates you have, the easier certificate management becomes.

All the following Exchange services use the same certificate on a given Exchange Client Access server:. Because only a single certificate can be associated with a website, and because all these services are offered under a single website by default, all the names that clients of these services use must be in the certificate or fall under a wildcard name in the certificate.

A separate certificate can be used for each receive connector that you configure. To simplify certificate management, consider including all names for which you have to support TLS traffic in a single certificate. Proxying is the method by which one server sends client connections to another server. In the case of Exchangethis happens when microsoft outlook 2013 cannot publish your certificates free Client Access server proxies an incoming client request to the Mailbox server that contains the active copy of the client's mailbox.

The self-signed certificate on the Mailbox server encrypts the traffic between the Client Access server and the Mailbox server. Many Exchange deployments use reverse proxies to publish Exchange services on the Internet.

Reverse proxies can be configured to terminate SSL encryption, examine the traffic in the clear on the server, and then open a new SSL encryption channel from the reverse proxy servers to the Exchange servers behind them.

This is known as SSL bridging. Another way to configure the reverse proxy servers is to let the SSL connections pass straight through to the Exchange publksh behind the reverse proxy servers. With either deployment model, the clients on the Internet connect to the reverse proxy server using a host name for Exchange access, such as mail. Then the reverse proxy server connects to Exchange using a different host name, such as the machine name of the Exchange Client Access server.

You don't have to include the machine name of the Exchange Client Access server on your certificate because most common reverse proxy servers are able to match the original host name mixrosoft used by the client to the mucrosoft host name of the Exchange Client Access microsfot. Split DNS is a technology that allows you to configure different IP publiwh for the same host name, depending on where the originating DNS request came from.

Split DNS can help you reduce the number of host names that you must manage for Exchange by allowing your clients to connect to Exchange through the same host name whether they're connecting from the Internet or from the intranet.

Split DNS allows requests that originate from the intranet to receive a different IP address than requests that originate from the Internet. Split DNS is usually unnecessary in a small Exchange deployment because users can access the ypur DNS endpoint whether they're coming from the intranet or the Internet.