Christos Polydorou

Today's article is about configuring Exchange receive connectors with specific certificates. Out of the box, Exchange uses self signed certificates to provide TLS secured mail flow. This will definitely be an issue if you expose the SMTP protocol to client computers since they won't trust the certificate. In this article we are going to configure a certificate that was issued by a third part authority to the Client Frontend receive connector. We'll start with getting the thumbprint of the certificate using the Get-ExchangeCertificate cmdlet: [PS] C:\> Get-ExchangeCertificate Thumbprint                               Subject ----------                               ------- 241B864DC82C664FECBA18B8D54987AAFB65B4C2 CN=*.lab.com, ... D4D210886B34E690191A1F008C78FDD0E7325DD4 CN=Exchange2013A 960171662EB26116...

Microsoft Exchange servers do not allow SMTP relay by default so you have to configure it yourself. But, before you allow relaying, make sure this is want you need. Let's go over a simple design for relaying. First of all, you have to create new receive connectors with the appropriate permissions. Make sure the "Anonymous" access is enabled and that the servers that need to relay are configured on the Remote IP Ranges. This way, only these servers will be able to relay. I also create A records in the DNS servers that point to the servers with the connectors and set the record's name as the HELO/EHLO response of the connectors. The following commands will extend the receive connectors in order to accept messages for any sender and accept any sender: Get-ReceiveConnector "Relay Exchange 1" |     Add-ADPermission -User 'NT AUTHORITY\Anonymous Logon' -ExtendedRights MS-Exch-SMTP-Accept-Any-Recipient Get-ReceiveConnector "Relay Ex...