Comments on: SAN Certificates and ISA Server 2006 http://blogs.msexchange.org/walther/2007/03/28/san-certificates-and-isa-server-2006/ Written by Henrik Walther, Microsoft MVP, the intention of this blog is to deliver the best content when it comes to information, news, tips and tweaks for the Microsoft Exchange Server product on topics such as mobile messaging, MONAD, and Active Directory integration. There is a discussion on various aspects of Exchange administration and management with a very special focus on Exchange Server 2007. Thu, 24 Jul 2008 15:13:54 +0000 http://wordpress.org/?v=MU by: OCS 2007 Installation - Part 2 | Confused Amused http://blogs.msexchange.org/walther/2007/03/28/san-certificates-and-isa-server-2006/#comment-126113 Wed, 05 Mar 2008 18:41:31 +0000 http://blogs.msexchange.org/walther/2007/03/28/san-certificates-and-isa-server-2006/#comment-126113 [...] Note: The reason the first SAN listed must be the same as the subject name is because of how ISA 2006 handles the reverse proxy. If we only left sip.confusedamused.com as the sole SAN entry everything would work fine internally, but we’d run into problems with the reverse proxy later. Since we’ll later tell ISA the internal site name is tap-ocs-2k7.ptown.com, but when it connects it tries to match the subject name to the first SAN listed. When it doesn’t line up ISA throws an Error 500 - Service Principal Name Incorrect. Doing the certificate this way now removes some unnecessary work later. You can read some more about this ISA issue here. [...] […] Note: The reason the first SAN listed must be the same as the subject name is because of how ISA 2006 handles the reverse proxy. If we only left sip.confusedamused.com as the sole SAN entry everything would work fine internally, but we’d run into problems with the reverse proxy later. Since we’ll later tell ISA the internal site name is tap-ocs-2k7.ptown.com, but when it connects it tries to match the subject name to the first SAN listed. When it doesn’t line up ISA throws an Error 500 - Service Principal Name Incorrect. Doing the certificate this way now removes some unnecessary work later. You can read some more about this ISA issue here. […]

]]> by: Henrik Walther http://blogs.msexchange.org/walther/2007/03/28/san-certificates-and-isa-server-2006/#comment-92059 Thu, 30 Aug 2007 17:49:29 +0000 http://blogs.msexchange.org/walther/2007/03/28/san-certificates-and-isa-server-2006/#comment-92059 Thanks for clarifying this Jim... Thanks for clarifying this Jim…

]]> by: Jim Harrison http://blogs.msexchange.org/walther/2007/03/28/san-certificates-and-isa-server-2006/#comment-91903 Wed, 29 Aug 2007 20:58:41 +0000 http://blogs.msexchange.org/walther/2007/03/28/san-certificates-and-isa-server-2006/#comment-91903 No hotfix plans have "changed"; no hotfix plans ever existed. Your sources were "misinformed". Please feel free to send them my way for gentle correcting. No hotfix plans have “changed”; no hotfix plans ever existed.
Your sources were “misinformed”.
Please feel free to send them my way for gentle correcting.

]]> by: Henrik Walther http://blogs.msexchange.org/walther/2007/03/28/san-certificates-and-isa-server-2006/#comment-91881 Wed, 29 Aug 2007 19:29:36 +0000 http://blogs.msexchange.org/walther/2007/03/28/san-certificates-and-isa-server-2006/#comment-91881 That is really bad news... :( My sources are actually individuals within MS, but I guess plans have changed then? That is really bad news… :(

My sources are actually individuals within MS, but I guess plans have changed then?

]]> by: Jim Harrison http://blogs.msexchange.org/walther/2007/03/28/san-certificates-and-isa-server-2006/#comment-91875 Wed, 29 Aug 2007 18:01:44 +0000 http://blogs.msexchange.org/walther/2007/03/28/san-certificates-and-isa-server-2006/#comment-91875 Feel free to yell at your "sources". No hotfix is currently planned. The ISA SE team is investigating the proper fix methodology. Watch the ISABlog on this subject for the "real word". Feel free to yell at your “sources”.
No hotfix is currently planned.
The ISA SE team is investigating the proper fix methodology.
Watch the ISABlog on this subject for the “real word”.

]]>