Wildcard cert for on-premise Exchange server

Question

Hi all!

I have one on-premise exchange 2019 server.
Server name: MAIL01
FQDN: mail01.company.local

I also have valid wildcard cert for my trusted domain.
*.company.hu

I have two problem:
When I want to add to Wildcard cert to POP and IMAP service, it is drop errors with FQDN problem.

This certificate with thumbprint **** and subject '*.company.hu' cannot used for POP SSL/TLS connections because the subject is not a Fully Qualified Domain Name (FQDN). Use command Set-POPSettings to set X509CertificateName to the FQDN of the service.
This certificate with thumbprint **** and subject '*.company.hu' cannot used for IMAP SSL/TLS connections because the subject is not a Fully Qualified Domain Name (FQDN). Use command Set-IMAPSettings to set X509CertificateName to the FQDN of the service.

When I want to reach owa from inside my org, it's always drop cert problem because cert is not trusted (i try reach from https://mail01.company.local name).

Answer 1

Hi @Szilágyi Sándor ,

For the first problem, this official document states: Do not enable wildcard certificates for IMAP and POP services.

Therefore, you should use the following command:

Set-POPSettings -X509CertificateName mail.doman.com  
Set-IMAPSettings -X509CertificateName mail.domain.com  

And then restart the IMAP and POP services
For more details, you could refer to configure-wildcard-ssl-certificate-for-pop-imap-on-exchange-2010-server
Please Note: Since these web sites are not hosted by Microsoft, the links may change without notice. Microsoft does not guarantee the accuracy of this information.

For the issue of untrusted certificates when accessing OWA, would you provide detailed error information to analyze the problem?

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Based on my knowledge, it is reasonable to get the error above when we try to assign POP3 or IMAP services to the certificates (or run Enable-ExchangeCertificate).
Actually, after configuring X509 CertificateName of POP3 settings and restart the POP3 service, it will work fine even though we cannot see POP in ECP GUI.
Here is a similar thread for reference:
Problems with assigning services to a wildcard certificate
The certificate can not be used for POP SSL/TLS
Issues with Wildcard Certificate for POP/IMAP

Answer 3

@LilyLi2-MSFT

I tried to set this, but it doesn't help me.
I added this command, but when i try to restart service, i got error text.

[PS] C:\Windows\system32>Restart-Service MSExchangeIMAP4; Restart-Service MSExchangeIMAP4BE  
Restart-Service : Service 'Microsoft Exchange IMAP4 (MSExchangeIMAP4)' cannot be stopped due to the following error: Cannot open MSExchangeIMAP4 service on computer '.'.  
At line:1 char:1  
+ Restart-Service MSExchangeIMAP4; Restart-Service MSExchangeIMAP4BE  
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
    + CategoryInfo          : CloseError: (System.ServiceProcess.ServiceController:ServiceController) [Restart-Service], ServiceCommandException  
    + FullyQualifiedErrorId : CouldNotStopService,Microsoft.PowerShell.Commands.RestartServiceCommand  
  
Restart-Service : Service 'Microsoft Exchange IMAP4 Backend (MSExchangeIMAP4BE)' cannot be stopped due to the following error: Cannot open MSExchangeIMAP4BE service on comput  
er '.'.  
At line:1 char:34  
+ Restart-Service MSExchangeIMAP4; Restart-Service MSExchangeIMAP4BE  
+                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
    + CategoryInfo          : CloseError: (System.ServiceProcess.ServiceController:ServiceController) [Restart-Service], ServiceCommandException  
    + FullyQualifiedErrorId : CouldNotStopService,Microsoft.PowerShell.Commands.RestartServiceCommand  

Answer 4

When i try add my wildcart cert to POP or IMAP service, i got this error:

This certificate with thumbprint ************ and subject '*.companyname.hu' cannot used for POP SSL/TLS connections because the subject is not a Fully Qualified Domain Name (FQDN). Use command Set-POPSettings to set X509CertificateName to the FQDN of the service.  

I use this command:

[PS] C:\Windows\system32>Set-POPSettings -X509CertificateName mail.companyname.hu  
WARNING: The command completed successfully but no settings of 'MAIL01\1' have been modified.