This article applies to:
- MailMarshal 10.X and above
Question:
- How long are the MailMarshal interface SSL certificates valid?
- Why is the Configuration Service failing to start with SSL errors?
- How do I renew a self-signed certificate for MailMarshal components?
Background:
MailMarshal installation creates two SSL certificates, one for the Management Console and one for the Configuration Service.
These certificates are valid for 5 years from the first installation. There is no automatic renewal.
When these certificates expire they must be renewed.
- The Configuration Service certificate is not visible to users and the expiration might be missed.
- If this certificate expires, the Console and Array Manager may not be able to function properly.
- The Console certificate is visible to users, and many customers choose to use a CA signed certificate.
- Expiry of this certificate is easier to notice.
Procedure:
To create a new self-signed certificate for either the Configuration Service or Console, use Windows Powershell. The certificates generated by IIS do not have certain flags required by current browsers.
Certificate creation in Powershell
To create a certificate in Powershell, run Powershell as administrator.
Use a command similar to the following. This command places the new certificate in the "Personal" store for the local computer.
new-selfsignedcertificate -dnsname "myMMserver" -subject "CN=myMMserver" `
-friendlyname "new-for-myMMserver" -KEYLENGTH 2048 `
-NotAfter $([datetime]::now.AddYears(5)) `
-CERTSTORELOCATION cert:\localmachine\my
For more information about certificate creation options, see the Related Links below.
Binding the websites
To apply a new certificate, open the IIS Manager on the MailMarshal Array Manager.
- If you need to import a CA signed certificate, see the Server Certificates item on the server root page.
- If you created a certificate with Powershell it will already be present.
To use the certificate:
- From the menu tree at left, expand Sites
- Select the required site (MailMarshal Management Console or MailMarshal Configuration Service).
- From the right menu click Bindings
- Edit the binding and select your new certificate.
- Click OK.
After replacing the certificate:
- For the Console, to ensure a new HTTPS connection you may need to fully close all browser windows and start again.
- For the Configuration Service, restart IIS and also ensure the Array Manager service is running.