By default, SharePoint has no root authority certificates installed. If SSL is configured on the Exchange server for web service access, the root authority certificate for the issuer of the Exchange server SSL certificate must be installed into SharePoint. The steps for this are broken down into two parts here: get the certificates, and install the certificates into SharePoint.

Get the Certificates:

1. On the SharePoint server, open Internet Explorer and browse to the Exchange Webmail URL.
2. Near the Address Bar, click the Lock icon and click View Certificates.



Click View Certificates

3. In the Certificate window, go to the Details tab.



Go to Details tab

4. On the Details tab, click Copy to File…..



Click Copy to File...

5. Export the certificate in the DER encoded binary X.509 (.CER) format to somewhere easily accessible.
6. Click the Certification Path tab.



Certificate Path

7. You’ve already exported the one listed on the bottom here. Click each of the other certificates in turn, clicking the View Certificate button for each when selected. New versions of the Certificate dialog should open for each.
8. Repeat steps C through E in each of the other certificate windows. You now have all the certificates required to install to SharePoint.
9. Close all your certificate windows when done.

Install the Certificates:

1. Open SharePoint Central Administration
2. Goto Security > General Security and click Manage Trust.
3. In the Ribbon, select New. The Establish Trust Relationship dialog appears.



Establish Trust Relationship diaglog

4. At the top, give the relationship a name.
5. In the next section, browse to the root certificate you exported above.
6. Leave the rest as is, and click OK.
7. Do this as well for all the other certificates you exported above. When finished, it should look similar to this.



 

Since the Exchange Managed API is making web service calls from the SharePoint backend, credentials must be explicitly provided when needed (they cannot be passed through from the current user’s credentials), and therefore must be stored in the Secure Store.

In order for these credentials to work in production, the account provided must have Exchange Impersonation rights. It is recommended that you create a new Active Directory service account to be used exclusively for this purpose.

Set up service account:

1. A domain administrator will need to create a service account in Active Directory.
2. An Exchange administrator will need to open either the Exchange Management Console or the Exchange Control Panel (if your organization uses Exchange Server 2010) or the Exchange Administration Center (if your organization uses Exchange Server 2013).
3. Add the Application Impersonation role to the service account. One way to do this is by creating a role group with the Application Impersonation role, and with the service account as a member of the group.

Install the Certificates:

1. Open Central Administration.
2. Go to Application Management >Manage Service Applications and click the link for Secure Store Service (or whatever custom name you may have given yours).
3. If you have not yet generated an encryption key, it will ask you to Generate New Key on the ribbon.
4. Select New on the ribbon.
5. Enter a Target Application ID, something like “MyCompanyExchange”. Take note of this because you will use this later when configuring the Exchange integration.
6. Set the Target Application Type to “Group”.
7. On the fields page, leave Windows User Name and Windows Password as they are and click Add Field. For the new field set the name to “Windows Domain” and type to “Generic”. (The field names must be like this and are case sensitive).
8. On the next page, set the Administrator to an account (usually the farm administrator) that will have the ability to change the credentials of the service account you’ll use for Exchange impersonation, which you set up in the previous section. Set as the Members a group representing your Aurea Social users … or at least those users who are to be able to use any of the Exchange integration features available in Aurea Social.
9. After the Target Application is created, select the drop down menu on your target application and select Set Credentials.
10. Set the user name, password, and domain of the service account you created for Exchange Impersonation.
11. Select OK.