[求助]求教-Exchange2007出现证书到期提示（12017、12018） [复制链接]

急救啊，请各位高手帮帮忙，在线等。

12018提示
The STARTTLS certificate will expire soon: subject: TEST.COM.CN, hours remaining: FAEDA25541860CB25EACDF5A4F3A049C0FEE2CF6. Run the New-ExchangeCertificate cmdlet to create a new certificate.

12017提示
An internal transport certificate will expire soon. Thumbprint:FAEDA25541860CB25EACDF5A4F3A049C0FEE2CF6, hours remaining: 658

建议参考下文重新创建证书：

http://www.stephenwagner.com/?p=435

如有疑问，请执行下列命令并将结果贴出来看看：

Get-ExchangeCertificate |fl

[PS] C:\Windows\system32>Get-ExchangeCertificate |fl


AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {webmail.jpe.cc, S08622.jinnpina.com.cn, S08622, autodisco
                     ver.jinnpina.com.cn}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=jinnpina-S08603-CA, DC=jinnpina, DC=com, DC=cn
NotAfter           : 4/30/2014 11:33:24 AM
NotBefore          : 4/30/2012 11:33:24 AM
PublicKeySize      : 2048
RootCAType         : Enterprise
SerialNumber       : 53780A82000000000010
Services           : IMAP, POP, UM, IIS, SMTP
Status             : Valid
Subject            : CN=webmail.jpe.cc, O=JPE, L=Zhuhai, S=Zhuhai, C=CN
Thumbprint         : FAEDA25541860CB25EACDF5A4F3A049C0FEE2CF6

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {S08622, S08622.jinnpina.com.cn}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : CN=S08622
NotAfter           : 11/23/2012 2:27:54 AM
NotBefore          : 11/23/2011 2:27:54 AM
PublicKeySize      : 2048
RootCAType         : Registry
SerialNumber       : 693F54FBE4538BA74B126459921E7766
Services           : UM, SMTP
Status             : DateInvalid
Subject            : CN=S08622
Thumbprint         : 725C0BAC45D055E87E7D54B1695C77E4E0CFE979

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {S08622, S08622.jinnpina.com.cn}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : CN=S08622
NotAfter           : 11/22/2012 1:30:37 AM
NotBefore          : 11/22/2011 1:30:37 AM
PublicKeySize      : 2048
RootCAType         : Registry
SerialNumber       : 2A5A932A0B8DF180465DDE7AD9F51CA1
Services           : UM, SMTP
Status             : DateInvalid
Subject            : CN=S08622
Thumbprint         : 059A748E1A4F381BBA4AE08A4A62E546EF2DE16F

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {S08622, S08622.jinnpina.com.cn}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : CN=S08622
NotAfter           : 11/19/2012 1:33:51 AM
NotBefore          : 11/19/2011 1:33:51 AM
PublicKeySize      : 2048
RootCAType         : Unknown
SerialNumber       : 3D088E4EF94CCE944868DC116F4A1B1E
Services           : UM, SMTP
Status             : Invalid
Subject            : CN=S08622
Thumbprint         : E18D507584D1BB5EB6124B23B9912801D3EAFB4E

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {S08622, S08622.jinnpina.com.cn}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : CN=S08622
NotAfter           : 11/18/2012 3:20:34 AM
NotBefore          : 11/18/2011 3:20:34 AM
PublicKeySize      : 2048
RootCAType         : Registry
SerialNumber       : A7D245633412D3BE408A9DC74FE2C276
Services           : UM, SMTP
Status             : DateInvalid
Subject            : CN=S08622
Thumbprint         : F137FC3A894F5B918978D182668CD2E60DF96471

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {s08612.jinnpina.com.cn}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=jinnpina-S08603-CA, DC=jinnpina, DC=com, DC=cn
NotAfter           : 11/4/2013 7:07:08 PM
NotBefore          : 11/5/2011 7:07:08 PM
PublicKeySize      : 1024
RootCAType         : Enterprise
SerialNumber       : 4E8F335B000000000005
Services           : None
Status             : DateInvalid
Subject            : CN=s08612.jinnpina.com.cn, OU=jpe, O=jpe, L=zh, S=gd, C=CN
Thumbprint         : B2EED7A82B03C2D92105751646A7F9E0E18ED612

达佰仕:[PS] C:\Windows\system32>Get-ExchangeCertificate |fl
AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
....... (2014-04-03 19:55) 

从输出结果看，第一张证书本月底要过期了，不过好在是内部CA颁发的证书。操作步骤如下：
1. 在EMC中选中该证书，在操作面板中选择更新证书。
2. 按照更新证书向导，生成一个证书请求文件。
3. 在浏览器中输入http://ca服务器名/certsrv
4. 将证书请求的内容输入到BASE64文本框中，完成证书请求。
5. 在EMC中选中这张证书请求，在操作面板中选择完成证书请求。
6. 按照向导将从CA服务器下载的证书导入。
7. 删除原证书。

你好，EMC中没有看到更新证书选项。
我直接用命令更新后，现在只报 12018 的提示 （The STARTTLS certificate will expire soon: subject: TEST.COM.CN, hours remaining: FAEDA25541860CB25EACDF5A4F3A049C0FEE2CF6. Run the New-ExchangeCertificate cmdlet to create a new certificate.）


命令更新如下：



[PS] C:\Windows\system32>New-ExchangeCertificate
WARNING: This certificate will not be used for external TLS connections with an
FQDN of 'S08622.jinnpina.com.cn' because the CA-signed certificate with
thumbprint 'FAEDA25541860CB25EACDF5A4F3A049C0FEE2CF6' takes precedence. The
following connectors match that FQDN: Default S08622, Client S08622.


Confirm
Overwrite existing default SMTP certificate,
'FAEDA25541860CB25EACDF5A4F3A049C0FEE2CF6' (expires 4/30/2014 11:33:24 AM),
with certificate 'D7961AFC4A4FF5753654CB86296CE3A0DBD7ED91' (expires 4/4/2015
11:52:58 AM)?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help
(default is "Y"):
选择Y


重新运行Get-ExchangeCertificate |fl 命令查看所有证书，得到的查询结果如下：



[PS] C:\Windows\system32>Get-ExchangeCertificate |fl


AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}CertificateDomains : {S08622, S08622.jinnpina.com.cn}
HasPrivateKey      : TrueIsSelfSigned       : True
Issuer             : CN=S08622NotAfter           : 4/4/2015 11:52:58 AM
NotBefore          : 4/4/2014 11:52:58 AMPublicKeySize      : 2048
RootCAType         : NoneSerialNumber       : F2B1F9E1D93E2EBC4F6150C6270934C0
Services           : UM, SMTPStatus             : Valid
Subject            : CN=S08622Thumbprint         : D7961AFC4A4FF5753654CB86296CE3A0DBD7ED91

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi                     ty.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {webmail.jpe.cc, S08622.jinnpina.com.cn, S08622, autodisco                     ver.jinnpina.com.cn}
HasPrivateKey      : TrueIsSelfSigned       : False
Issuer             : CN=jinnpina-S08603-CA, DC=jinnpina, DC=com, DC=cnNotAfter           : 4/30/2014 11:33:24 AM
NotBefore          : 4/30/2012 11:33:24 AMPublicKeySize      : 2048
RootCAType         : EnterpriseSerialNumber       : 53780A82000000000010
Services           : IMAP, POP, UM, IIS, SMTPStatus             : Valid
Subject            : CN=webmail.jpe.cc, O=JPE, L=Zhuhai, S=Zhuhai, C=CNThumbprint         : FAEDA25541860CB25EACDF5A4F3A049C0FEE2CF6

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}CertificateDomains : {S08622, S08622.jinnpina.com.cn}
HasPrivateKey      : TrueIsSelfSigned       : True
Issuer             : CN=S08622NotAfter           : 11/23/2012 2:27:54 AM
NotBefore          : 11/23/2011 2:27:54 AMPublicKeySize      : 2048
RootCAType         : RegistrySerialNumber       : 693F54FBE4538BA74B126459921E7766
Services           : UM, SMTPStatus             : DateInvalid
Subject            : CN=S08622Thumbprint         : 725C0BAC45D055E87E7D54B1695C77E4E0CFE979

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}CertificateDomains : {S08622, S08622.jinnpina.com.cn}
HasPrivateKey      : TrueIsSelfSigned       : True
Issuer             : CN=S08622NotAfter           : 11/22/2012 1:30:37 AM
NotBefore          : 11/22/2011 1:30:37 AMPublicKeySize      : 2048
RootCAType         : RegistrySerialNumber       : 2A5A932A0B8DF180465DDE7AD9F51CA1
Services           : UM, SMTPStatus             : DateInvalid
Subject            : CN=S08622Thumbprint         : 059A748E1A4F381BBA4AE08A4A62E546EF2DE16F

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}CertificateDomains : {S08622, S08622.jinnpina.com.cn}
HasPrivateKey      : TrueIsSelfSigned       : True
Issuer             : CN=S08622NotAfter           : 11/19/2012 1:33:51 AM
NotBefore          : 11/19/2011 1:33:51 AMPublicKeySize      : 2048
RootCAType         : UnknownSerialNumber       : 3D088E4EF94CCE944868DC116F4A1B1E
Services           : UM, SMTPStatus             : Invalid
Subject            : CN=S08622Thumbprint         : E18D507584D1BB5EB6124B23B9912801D3EAFB4E

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}CertificateDomains : {S08622, S08622.jinnpina.com.cn}
HasPrivateKey      : TrueIsSelfSigned       : True
Issuer             : CN=S08622NotAfter           : 11/18/2012 3:20:34 AM
NotBefore          : 11/18/2011 3:20:34 AMPublicKeySize      : 2048
RootCAType         : RegistrySerialNumber       : A7D245633412D3BE408A9DC74FE2C276
Services           : UM, SMTPStatus             : DateInvalid
Subject            : CN=S08622Thumbprint         : F137FC3A894F5B918978D182668CD2E60DF96471

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi                     ty.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {s08612.jinnpina.com.cn}HasPrivateKey      : True
IsSelfSigned       : FalseIssuer             : CN=jinnpina-S08603-CA, DC=jinnpina, DC=com, DC=cn
NotAfter           : 11/4/2013 7:07:08 PMNotBefore          : 11/5/2011 7:07:08 PM
PublicKeySize      : 1024RootCAType         : Enterprise
SerialNumber       : 4E8F335B000000000005Services           : None
Status             : DateInvalidSubject            : CN=s08612.jinnpina.com.cn, OU=jpe, O=jpe, L=zh, S=gd, C=CN
Thumbprint         : B2EED7A82B03C2D92105751646A7F9E0E18ED612

达佰仕:你好，EMC中没有看到更新证书选项。
我直接用命令更新后，现在只报 12018 的提示 （The STARTTLS certificate will expire soon: subject: TEST.COM.CN, hours remaining: FAEDA25541860CB25EACDF5A4F3A049C0FEE2CF6. Run the New-ExchangeCertificate cmdlet to create a new ce .. (2014-04-07 10:46) 

你只更新了自签名的证书，我说的从根CA颁发的那个SMTP的证书没有更新。
就是下面这张：
AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi                     ty.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {webmail.jpe.cc, S08622.jinnpina.com.cn, S08622, autodisco                     ver.jinnpina.com.cn}
HasPrivateKey      : TrueIsSelfSigned       : False
Issuer             : CN=jinnpina-S08603-CA, DC=jinnpina, DC=com, DC=cnNotAfter           : 4/30/2014 11:33:24 AM
NotBefore          : 4/30/2012 11:33:24 AMPublicKeySize      : 2048
RootCAType         : EnterpriseSerialNumber       : 53780A82000000000010
Services           : IMAP, POP, UM, IIS, SMTPStatus             : Valid
Subject            : CN=webmail.jpe.cc, O=JPE, L=Zhuhai, S=Zhuhai, C=CNThumbprint         : FAEDA25541860CB25EACDF5A4F3A049C0FEE2CF6

请参考：
http://blogs.microsoft.co.il/roneng/2008/03/20/create-certificate-for-exchange-2007-servers-using-windows-ca/

更新后还出现12018 报错 ，OWA访问也不正常
技术信息(提供给支持人员)

• 错误代码: 500 Internal Server Error。证书链是由不受信任的颁发机构颁发的。 (-2146893019)

下面是最新的证书内容
[PS] C:\Windows\system32>Get-ExchangeCertificate |fl


AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {webmail.jpe.cc, S08622.jinnpina.com.cn, S08622, autodisco
                     ver.jinnpina.com.cn}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : C=CN, S=Zhuhai, L=Zhuhai, O=JPE, CN=webmail.jpe.cc
NotAfter           : 4/8/2015 5:27:56 PM
NotBefore          : 4/8/2014 5:27:56 PM
PublicKeySize      : 2048
RootCAType         : None
SerialNumber       : A11FF2377E87A5954E9FA2C52BBDD137
Services           : IMAP, POP, UM, IIS, SMTP
Status             : Valid
Subject            : C=CN, S=Zhuhai, L=Zhuhai, O=JPE, CN=webmail.jpe.cc
Thumbprint         : 37A8F1F1EF15A45606065500ECE1AEDFA68B1B36

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {webmail.jpe.cc, S08622.jinnpina.com.cn, S08622, autodisco
                     ver.jinnpina.com.cn}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : C=CN, S=Zhuhai, L=Zhuhai, O=JPE, CN=webmail.jpe.cc
NotAfter           : 4/8/2015 5:23:49 PM
NotBefore          : 4/8/2014 5:23:49 PM
PublicKeySize      : 2048
RootCAType         : None
SerialNumber       : 6695890457AEACB64D5DA4525D9F6742
Services           : IMAP, POP, UM, SMTP
Status             : Valid
Subject            : C=CN, S=Zhuhai, L=Zhuhai, O=JPE, CN=webmail.jpe.cc
Thumbprint         : 4AAB91ADE2B521F0595CB6F6EC4693F4022CECF2

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {S08622, S08622.jinnpina.com.cn}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : CN=S08622
NotAfter           : 4/8/2015 4:26:22 PM
NotBefore          : 4/8/2014 4:26:22 PM
PublicKeySize      : 2048
RootCAType         : None
SerialNumber       : D3AE67D1D76BD8A740892196EAFCA87B
Services           : UM, SMTP
Status             : Valid
Subject            : CN=S08622
Thumbprint         : 56CAB941775013485A5364589754880CB4F472E2

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {S08622, S08622.jinnpina.com.cn}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : CN=S08622
NotAfter           : 4/8/2015 3:56:15 PM
NotBefore          : 4/8/2014 3:56:15 PM
PublicKeySize      : 2048
RootCAType         : None
SerialNumber       : F6D6225E796EA3914A4411C4315C92E8
Services           : UM, SMTP
Status             : Valid
Subject            : CN=S08622
Thumbprint         : FB82B9F31A4ACA60A5DCE7D99B26E808C57DB683

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {S08622, S08622.jinnpina.com.cn}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : CN=S08622
NotAfter           : 4/8/2015 11:13:33 AM
NotBefore          : 4/8/2014 11:13:33 AM
PublicKeySize      : 2048
RootCAType         : None
SerialNumber       : 4816A5C9A0BBA2A644E8D34B08DD614A
Services           : UM, SMTP
Status             : Valid
Subject            : CN=S08622
Thumbprint         : 35F5ABCE9E58389709BAC65F3993B2648EC2FA44

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule, System.Security.Acce
                     ssControl.CryptoKeyAccessRule}
CertificateDomains : {S08622, S08622.jinnpina.com.cn}
HasPrivateKey      : True
IsSelfSigned       : True
Issuer             : CN=S08622
NotAfter           : 4/4/2015 11:52:58 AM
NotBefore          : 4/4/2014 11:52:58 AM
PublicKeySize      : 2048
RootCAType         : None
SerialNumber       : F2B1F9E1D93E2EBC4F6150C6270934C0
Services           : UM, SMTP
Status             : Valid
Subject            : CN=S08622
Thumbprint         : D7961AFC4A4FF5753654CB86296CE3A0DBD7ED91

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule, System
                     .Security.AccessControl.CryptoKeyAccessRule, System.Securi
                     ty.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {webmail.jpe.cc, S08622.jinnpina.com.cn, S08622, autodisco
                     ver.jinnpina.com.cn}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=jinnpina-S08603-CA, DC=jinnpina, DC=com, DC=cn
NotAfter           : 4/30/2014 11:33:24 AM
NotBefore          : 4/30/2012 11:33:24 AM
PublicKeySize      : 2048
RootCAType         : Enterprise
SerialNumber       : 53780A82000000000010
Services           : IMAP, POP, UM, SMTP
Status             : Valid
Subject            : CN=webmail.jpe.cc, O=JPE, L=Zhuhai, S=Zhuhai, C=CN
Thumbprint         : FAEDA25541860CB25EACDF5A4F3A049C0FEE2CF6

达佰仕:更新后还出现12018 报错 ，OWA访问也不正常
技术信息(提供给支持人员)

错误代码: 500 Internal Server Error。证书链是由不受信任的颁发机构颁发的。 (-2146893019)

....... (2014-04-08 18:39) 

根据12018的报错内容，是指纹码为FAEDA25541860CB25EACDF5A4F3A049C0FEE2CF6的证书没有更新。

而且看了你三次get-exchangecertificate的结果，这张证书都没有更新。

你先更新这张证书再试下owa访问吧

证书在 Exchange 2007 Server 中的使用
http://technet.microsoft.com/zh-cn/library/bb851505(v=exchg.80).aspx

问题已解决，谢谢！

你好，可以问下，你怎么解决的嘛？我也遇到了和你一样的问题！