Forum Discussion
carter91_13591
Nimbostratus
NimbostratusMicrosoft Exchange 2013 iApp - Can't login to OWA or ECP if more than one server is active in pool
I just deployed the latest 2013 iApp for Exchange 2013. We have 5 servers, and the iApp deployment went good and quick. However, we can not log into OWA or the ECP when more than one pool member is active. You get to the login page, you type your username and password and it looks like it's logging you in for a brief moment, then kicks you back to the logon page. If I go into the OWA pool, and disabled all but one of the members, you can log in and access your mailbox or ECP just fine.
Anything you can think of to look at? I have a support case with F5, but sometimes people on here have ran into this before.
carter91_13591We lose the EAC restriction based on IP address in the 2010 template among other things. Would like to get this working with 2013 option.
Every time I've run into this problem, it's been the certificate issue. I recommend that you consider opening a support case with Microsoft as well, since they might be able to spot something that I'm missing.
The F5 support engineer will be able escalate the case if necessary.
Can you tell me which version of Exchange 2013 you are running? Should be able to get that from the servers list in the EAC.
- carter91_13591
Exchange 2013 SP1 with CU5 applied
Do our internal server names have to be on the certificate as well?
No, the internal server names are not required, only the names that clients will use to connect.
The CAS servers also have the private key, correct?
- carter91_13591
Yes they do, it accepted everything when I imported.
I switched everything to our Wildcard cert on both the F5 and the servers, and no change in behavior.
I know both these certs are good. Our 2010 environment is using the Outlookweb cert currently, and we have multiple servers using the wildcard. So I know the cert itself is good, and they should now match like you said they needed to.
- carter91_13591
Both our wildcard and the exchange certs we used had CSR's generated from the F5, the submitted to Thawte, then the issued certs from them were installed on F5. To get them on the servers, I exported the .crt and .key files and used OpenSSL to combine them to install on Exchange servers. That would be ok right?
That seems OK to me, however we do all our testing with self-signed certs so I can't tell you for sure that there's not a problem or best practice with that process. Can you grab the cert and key in .pfx format from Thawte, then import that onto both BIG-IP and your Exchange servers?
- carter91_13591
Thawte only has the cert...the key is stored on the F5, or requesting server.
Duh, that's why it's a private key I guess. :-)
What openssl commands did you use to combine them?
