As part of establishing e-mail coexistence between your local Microsoft Exchange Server environment and Microsoft Exchange Online, we recommend that you implement Transport Layer Security (TLS) send and receive capability in your local Exchange Server environment. This is necessary because, during coexistence with Exchange Online, e-mail that was previously sent and received within your organization will now be sent over the Internet. The instructions in this topic describe how to secure e-mail traffic on Microsoft Exchange 2000 Server and Exchange Server 2003. If your local Exchange Server environment is using Microsoft Exchange Server 2007, refer to your Exchange Server documentation for this information.
To secure your e-mail traffic with TLS, you will require a certificate that is granted by a recognized certification authority (CA). To implement TLS in your local Exchange Server environment, you are required to:
- Identify the Exchange Server on which to install the
certificate.
- Generate a certificate request.
- Acquire the certificate.
- Install the certificate.
- Create a Simple Mail Transfer Protocol (SMTP) connector.
- Enable TLS.
For more information about TLS, see What is TLS/SSL?
Step One: Identify the Exchange Server on Which to Install the Certificate
TLS should be enabled on the bridgehead server of your local Exchange Server environment. That is the computer that directs your organization's e-mail to and from the Internet. For more information about bridgehead servers and Exchange Server message routing, see Exchange Server 2003 Message Routing Topology.
If you have separate bridgehead servers for sending and receiving e-mail from the Internet, you will need to acquire and install a certificate on the SMTP server of each bridgehead server computer running Exchange Server; however, you will need to set up a connector and enable TLS only on the server that is used for sending e-mail to the Internet.
 Note: |
|---|
|
If you have a local Exchange Server bridgehead server running the standard SMTP virtual server, continue reading this topic.
Step Two: Generate a Certificate Request
Use Exchange System Manager in Exchange Server to generate a certificate request on your bridgehead server. You must provide the fully qualified domain name (FQDN) of the bridgehead server. For more information, see Creating a Certificate or Certificate Request for TLS.
Step Three: Acquire the Certificate
Locate a recognized certification authority (CA), such as VeriSign, Comodo, or GoDaddy. Submit the certificate request file that you generated in the previous section. The CA will provide you with a certificate (CER) file that contains the certificate for your server.
Step Four: Install the Certificate
Use Exchange System Manager to install the certificate file. You must provide the path to the certificate file that you received from the CA.
Step Five: Create an SMTP Connector
Create an SMTP connector for sending e-mail to Microsoft Online Services.
To create an SMTP connector-
In Exchange System Manager, right-click Connectors, and then click New SMTP Connector.
-
Type a name for the connector (for example, MicrosoftOnline).
-
On the General tab, select Forward all e-mail through this connector to the following smart host, and then type mail.global.frontbridge.com.
-
Under Local Bridgeheads, click Add, and then select your bridgehead server computer running Exchange Server.
-
On the Address Space tab, click Add, and then type your organization's Microsoft Online Services e-mail routing domain (for example, contoso1.microsoftonline.com).
| Note: |
|---|
| To determine your organization's Microsoft Online Services e-mail routing domain, log on to the Microsoft Online Services Administration Center, click the Migration tab, and then click E-Mail Coexistence. The domain will be listed in the E-Mail Routing Information pane. |
For more information about creating SMTP connectors, see How to configure the SMTP connector in Exchange 200x.
Step Six: Enable TLS
After you install the certificate, your server will be able to receive TLS e-mail. However, it cannot send TLS e-mail until you enable TLS.
To enable TLS-
In Exchange System Manager, expand Connectors and locate the MicrosoftOnline connector that you created in the previous procedure.
-
Right-click the connector, and then click Properties.
-
On the Advanced tab, click Outbound Security, and then select TLS Encryption.
