SSL cert for Exchange 2013

Hi Dela,

The first line of the output you've posted says:

You didn't get past the validation process of the domain names that you specified. To get more information, check the generated acme_[timestamp].log under c:\certificates. Do you get "invalid" status for the names? If that's the case, you need to find out why the domain name validation is failing. Try getting the generated validation strings (under C:\inetpub\wwwroot.well-known\acme-challenge) from another computer on the local network first - like "http://exchangeintservername/.well-known/acme-challenge/challenge_file_name". Then try from external machine - it could be the firewall not allowing port 80.

Another reason for the "invalid" status could be the case when you are using a load balancer and multiple Exchange CAS; the files might be generated on one CAS, and the request forwarded to another - you need to configure port 80 to go to just one of the Exchange CAS behind the load balancer.

Last week, I had a very weird failure for validation of the FQDN in the cert - some of the names validated successfully and some failed - because the exchange server was delaying the challenge response. The LE timeout seems to be 5 sec, and for some reason the correct challenge response was provided by the Web Server with delay more than LE timeout. Here is the thread about this issue:

Inconsistent LE responses http-01 invalid/valid - wireshark captures

I am still trying to figure out why the Exchange front-end web site is delaying intermittently the response which consists of a single text file containing a single line - the challenge.

Again, check the logs for more info.