<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>This is a public, follow-up response to a question about certificates for Internal Names from Filip <span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Dossche.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Filip asked (1) whether both an internal and external certificate will be needed for hosts with internal server names and (2) how does the digicert tool work? <a href="http://www.digicert.com/internal-domain-name-tool.htm">http://www.digicert.com/internal-domain-name-tool.htm</a> ? I’ll answer the first question last.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>According to the Baseline Requirements “Internal Server Name” is one that is “not resolvable using the public DNS.” <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Publicly trusted CAs and Browsers are phasing out Internal Names in publicly trusted SSL/TLS certificates totally by October 1, 2016. Some of the reasons for this may be found here - https://www.cabforum.org/Guidance-Deprecated-Internal-Names.pdf As previously communicated, no CA should be issuing an SSL certificate with an expiry date past November 1, 2015 that has an Internal Server Name, even if it is not reachable from the Internet. Also, all CAs should be advising all customers receiving 1-year and 2-year certificates with Internal Names that the practice is being phased out.<o:p></o:p></span></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>This presents a problem for many types of networks. For enterprises currently using MS Exchange with internal host name configurations that still need a publicly trusted certificate but want to make the transition now, Digicert created a free tool that will help convert those internal names to FQDNs. <o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Instructions for the tool indicate that you run it on any Exchange Client Access Server <span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>AFTER you </span>have already generated and installed the key pair and a new FQDN-compliant certificate on all servers mentioned in the certificate. The tool does not change the actual certificate (you need to get that certificate re-issued by the CA with FQDNs ahead of time), it simply reconfigures Exchange’s internal and external routing to comply with industry best practices for domain naming with FQDNs instead of internal names.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>So, to answer your first question, one solution is to convert your internal names to FQDNs so that you can use the same certificate. The tool is just one example of how this can be done. If you need more detail, please let me know.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Ben<o:p></o:p></p></div></body></html>