How to Renew Exchange Certificate?

6.2K

Exchange Servers use SSL certificates to encrypt connections between the client and servers. Whether using Outlook Desktop or on the web, the SSL certificate provides a way to protect client-server communication from prying eyes.

But SSL certificates have an expiration date. If the certificate expires without you noticing, users will see a pop-up message when starting Outlook, similar to the one below.

You must renew the Exchange certificate to fix the error when this happens. The procedure will vary and depends on whether the SSL certificate is self-signed or issued by a certification authority. In this tutorial, we’ll learn how to do both.

Note. Starting from Exchange Server 2019 CU12 and Exchange Server 2016 CU23, renewing an Exchange Server certificate from the GUI (Exchange Admin Center) is no longer available. You can only renew certificates using PowerShell.

Before You Renew an Exchange Certificate

Before renewing an Exchange certificate, we recommend you to review the currently installed certificates and verify which one is actively used by Exchange services.

To list all Exchange certificates, run the command:

Get-ExchangeCertificate |
Select-Object Thumbprint, Subject, CertificateDomains, Services, NotAfter |
Format-List

You need to check the following information:

• Certificate expiration date (NotAfter)
• Assigned Exchange services (IIS, SMTP, POP, IMAP)
• Subject Alternative Names (SAN)
• Wildcard certificate usage
• Certificate thumbprint

In case multiple certificates are installed, you should identify which certificate is currently assigned to IIS and SMTP before starting the renewal process.

In order to display detailed certificate info, run the command:

Get-ExchangeCertificate -Thumbprint <thumbprint> |
Format-List *

You should pay special attention to:

• Subject
• Issuer
• CertificateDomains
• Services
• NotBefore
• NotAfter
• IsSelfSigned

In case the certificate is issued by a public certification authority, you should verify if all required Exchange namespaces are present in the SAN list. This includes:

• mail.contoso.com
• autodiscover.contoso.com

In case a wildcard certificate is used (for example *.contoso.com), you need to verify if it still satisfies all Exchange namespace requirements before requesting a renewal.

Validate Subject Alternative Names (SAN)

Before generating a certificate renewal request, you need to verify if the current Subject Alternative Name (SAN) list still matches your Exchange deployment requirements.

Many admins simply renew the existing certificate and reuse the old SAN config. However, Exchange environments often change over time:

• New Exchange namespaces may have been introduced
• Autodiscover URLs may have changed
• Load balancer VIP names may have been added
• Hybrid Exchange endpoints may have been reconfigured
• Legacy namespaces may no longer be required

In order to review the current certificate SAN entries, run the following command:

Get-ExchangeCertificate -Thumbprint <thumbprint> |
Select-Object -ExpandProperty CertificateDomains

Before generating the renewal request, you should verify that all required Exchange namespaces are included.

In case you are using a wildcard certificate (*.contoso.com), ensure that all required Exchange services are still covered by the wildcard scope.

Important. Note that in case you renew a certificate without reviewing SAN entries, this may result in Outlook, Autodiscover, Exchange Hybrid, or load-balanced services failing after certificate replacement.

Backing up the Existing Certificate

Before renewing or replacing an Exchange certificate, we recommend exporting the current certificate together with its private key. This allows you to quickly roll back if certificate installation/service assignment fails.

In order to export the certificate:

$file = Export-ExchangeCertificate `
-Thumbprint <thumbprint> `
-BinaryEncoded `
-Password (Get-Credential).Password

[System.IO.File]::WriteAllBytes(
"C:\Backup\ExchangeCertificate.pfx",
$file.FileData
)

The Export-ExchangeCertificate cmdlet returns the certificate data to the pipeline and does not save it directly to a file. Keep in mind that you should store the returned object in a variable and use WriteAllBytes() to create the PFX backup file.

Or you can export it from the Certificates MMC snap-in (as a PFX file). Note that you should store the backup securely and check that the private key is included.

Renewing a Self-Signed Exchange Certificate

If your Exchange Server uses a self-signed certificate, you can quickly renew it. The renewal process basically means that you’re creating a new certificate based on the old one.

Using the Exchange Admin Center

Follow these instructions to renew a self-signed Exchange Server certificate using the EAC.

1. Log in to your Exchange Admin Center at https://your_exch_srv_fqdn/ecp/.
2. Navigate to server > certificates.
3. Select the server from the dropdown list, select the certificate you wish to renew, and click the Renew link on the right:
   

   

4. On the Renew Exchange certificate pop-up window, click OK.
   

   

   The certificate will be renewed, and the old one will be removed. As you can see below, the certificate is now valid.
   

   

Reminder. This procedure works only with versions before Exchange Server 2019 CU12 and Exchange Server 2016 CU23. If your Exchange Server version is newer, you can only renew the certificate in PowerShell.

Using PowerShell

To renew the self-signed Exchange certificate via PowerShell, proceed as follows.

1. Open the Exchange Management Shell and run this command to list the current Exchange certificates:
   

   Get-ExchangeCertificate | Select-Object Thumbprint,Subject,Services,NotBefore,NotAfter

2. Look for the certificate to renew and copy its thumbprint value.
   

   

3. Now, let’s renew the certificate. This command gets the certificate object with the E6EC2420EE5CC….A39D9AAC1774D122 thumbprint and creates a new certificate based on its details.
   

   Get-ExchangeCertificate -Thumbprint E6EC2420EE5CCD7B8F988573A39D9AAC1774D122 | ` 
   
   New-ExchangeCertificate -Force -PrivateKeyExportable $true

   

   The new certificate has been created.

4. Copy the new certificate’s thumbprint and run the below command to assign all services to use it:
   

   # Assign Services. 
   
   Enable-ExchangeCertificate ` 
   
   -Thumbprint C37E73C7E1C6878A6D21F59A1707847D7F2D97AF ` 
   
   -Services IIS, IMAP, POP, SMTP 
   
   # Confirm the new certificate details. 
   
   Get-ExchangeCertificate ` 
   
   -Thumbprint C37E73C7E1C6878A6D21F59A1707847D7F2D97AF | ` 
   
   Select-Object Thumbprint, Subject, Services, NotBefore, NotAfter

   

   The result below shows that the renewed certificate has been installed, and the services have been assigned.

Post-Renewal Tasks

Since renewing a self-signed Exchange certificate is essentially creating a new one, the server, and other clients do not trust this new certificate.

To get rid of this certificate error and ensure the devices trust this certificate, you must copy the certificate from the Personal store to the Trusted Root Certification Authority store.

Note that we generally recommend using self-signed certificates only for testing/internal environments. Keep in mind that internet-facing Exchange deployments should use certificates issued by a trusted certification authority.

Of course, you shouldn’t do this manually on all Windows devices. Perhaps you can deploy these certificates via group policy or logon scripts. The same goes for non-Windows devices, but that’s not covered in this tutorial.

Renew a CA-Issued Exchange Certificate

In larger organizations, or when the Exchange Server is published externally, it is common to see certificates issued by a certification authority rather than self-signed. Renewing this type of certificate is more nuanced since another party is involved in issuing the certificate.

Below are the high-level steps in this Exchange certificate renewal scenario:

1. The admin generates the certificate signing request (CSR).
2. The admin submits the request to the issuer.
3. The issuer accepts the request and generates the new Exchange SSL certificate.
4. The issue sends the renewed certificate to the admin.
5. The admin installs the new Exchange certificate.

We’ll perform this task in the following sections via the Exchange Admin Center and PowerShell.

Using the Exchange Admin Center

1. Log in to your Exchange Admin Center at https://your_exch_srv_fqdn/ecp/.
2. Navigate to server > certificates.
3. Select the server from the dropdown list, select the certificate you wish to renew, and click the Renew link on the right.
   In the below screenshot, you can see that the certificate will expire in two days.
   

   

4. Enter the UNC path to save the certificate request file on the pop-up window. Make sure that this UNC path exists and is accessible. Click OK.
   

   

5. Now, locate the certificate request file you generated and submit it to your certificate issuer. The issuer could be an internal CA or a third-party CA like DigiCert, GoDaddy, etc.
   

   

6. Assuming that the CA has issued the new certificate, most likely in *.cer format, copy it to the UNC path.
   

   

7. Back on the EAC, click Complete.
   

   

8. On the next window, enter the UNC path of the new certificate and click OK.
   

   

9. The certificate status has now changed to Valid, meaning the renewal was successful. But as you can see below, the SMTP and IIS services were not automatically assigned to the new certificate. To assign service, click the Edit button.
   

   

10. Navigate to services, check the SMTP and IIS boxes, and click Save.
    

    

11. When you get a warning about overwriting the existing certificate assignment, click Yes.
    

    

    The Exchange services are now assigned to the new certificate.
    

    

Reminder. This procedure works only with versions before Exchange Server 2019 CU12 and Exchange Server 2016 CU23. If your Exchange Server version is newer, you can only renew the certificate in PowerShell.

Validating the Certificate Request Before Submission

Before submitting the certificate signing request (CSR) to your certification authority, you need to check if it contains all required Exchange namespaces and certificate attributes.

Note that many Exchange certificate problems occur because admins simply renew an existing certificate without reviewing its config. Over time, Exchange environments may change and require additional Subject Alternative Names (SANs).

You should review the certificate request config and ensure that:

• All required Exchange namespaces are included;
• Autodiscover URLs are covered;
• Load balancer or reverse proxy names are present (in case required);
• Exchange Hybrid endpoints are included when applicable;
• Legacy namespaces that are no longer used have been removed.

You can review the current certificate config with the following command:

Get-ExchangeCertificate -Thumbprint <thumbprint> |
Select-Object Subject, CertificateDomains, NotAfter |
Format-List

Using PowerShell

Follow these steps to renew a certificate issued by a certificate authority using PowerShell.

1. Open the Exchange Management Shell and run this command to list all Exchange certificates:
   

   Get-ExchangeCertificate | Select-Object Thumbprint,Subject,Services,NotBefore,NotAfter

2. Find the expiring or expired certificate that you plan to renew. Copy its thumbprint for the next step.
   
3. Now that you’ve determined the certificate thumbprint to renew, run the below commands:
   

   ## Create a Base64 encoded certificate request 
   
   $certRequest = Get-ExchangeCertificate ` 
   
   -Thumbprint 76B73B456B9ECF746D282F271ED6AA8DABCFD37C | ` 
   
   New-ExchangeCertificate -GenerateRequest 
   
   ## Save the CSR to a file 
   
   [System.IO.File]::WriteAllBytes('\\exc1.o365things.ml\c$\certreq\certificate_renewal.req', ` 
   
   [System.Text.Encoding]::Unicode.GetBytes($certRequest))

   

   The first command retrieves the existing certificate with thumbprint 76B73B456B9E…AA8DABCFD37C and uses its details to create a request. The second command exports the request to a file in the UNC path \\exc1.o365things.ml\ c$\ certreq\ certificate_renewal.req.

4. Submit the resulting certificate request to your CA.
   
5. Once you receive the new certificate from the issuer, copy it to the UNC path of your choice. In this example, let’s put it in the same UNC path as the certificate request file.
   
6. Back in PowerShell, run this command to complete the certificate renewal. This example imports the \\exc1.o365things.ml\ c$\ certreq\ certnew.cer certificate that doesn’t require a password. Also, the certificate’s private key will be exportable as defined by the -PrivateKeyExportable $true parameter.
   

   Import-ExchangeCertificate -FileData ` 
   
   ([System.IO.File]::ReadAllBytes('\\exc1.o365things.ml\c$\certreq\certnew.cer')) ` 
   
   -PrivateKeyExportable $true

   

   The Exchange certificate has been imported. Copy the new certificate’s thumbprint.

   Before assigning the certificate to Exchange services, verify that the private key was imported successfully. Run the following command:
   Get-ExchangeCertificate -Thumbprint <new_thumbprint> | Format-List Subject,HasPrivateKey,Services
   The HasPrivateKey property should return True. If it is False, the certificate cannot be assigned to Exchange services because the associated private key is missing. This commonly occurs when the certificate is imported incorrectly/when the private key is not included in the certificate file.

7. Before assigning the certificate to IIS and SMTP services, you should check that the imported certificate contains the correct SAN names, issuer, expiration date, and private key. You can review the certificate details with the command:

   Get-ExchangeCertificate -Thumbprint <new_thumbprint> | Format-List *

8. Run the below command to assign the IIS, SMTP, POP, and IMAP services to the certificate. Make sure to replace the thumbprint value before running the command.
   

   Enable-ExchangeCertificate ` 
   
   -Thumbprint 1870728CA24594EC2378675EF4819AAD0F7FC7D1 ` 
   
   -Services IIS, IMAP, POP, SMTP ` 
   
   -Force

9. Finally, confirm that the new certificate is valid and has all the Exchange services assigned.
   

   Get-ExchangeCertificate ` 
   
   -Thumbprint 1870728CA24594EC2378675EF4819AAD0F7FC7D1 | ` 
   
   Select-Object Thumbprint, Subject, Services, NotBefore, NotAfter

   That’s it! You’ve renewed the Exchange server certificate.

   
10. In OWA or ECP, the new certificate will be used by Exchange to encrypt the connection.
    

    

Post-Renewal Validation Checklist

After assigning the renewed certificate to Exchange services, you should verify that all required services are functioning correctly before removing the old certificate.

In order to confirm the certificate assignment, run the following command:

Get-ExchangeCertificate |
Select Thumbprint,Subject,Services,NotAfter

You should check if the expected services are assigned:

• IIS
• SMTP
• POP (if used)
• IMAP (if used)
• Verify Exchange URLs

Now verify if the configured Exchange URLs are still valid and covered by the certificate SAN list:

Get-OwaVirtualDirectory |
Select Identity,InternalUrl,ExternalUrl

Get-WebServicesVirtualDirectory |
Select Identity,InternalUrl,ExternalUrl

Get-ActiveSyncVirtualDirectory |
Select Identity,InternalUrl,ExternalUrl

Get-ClientAccessService |
Select Name,AutoDiscoverServiceInternalUri
Test Outlook and Autodiscover

Using commands above, you need to verify if Outlook clients can connect successfully and that Autodiscover returns valid config info.

Now test the following URLs from a browser:

https://mail.contoso.com/owa

https://autodiscover.contoso.com

Verify IIS Certificate Assignment

At this step. you should check if Exchange IIS services are presenting the renewed certificate and not an older certificate still installed on the server. Run the command:

Get-ExchangeCertificate |
Select Thumbprint, Subject, Services

You should check and confirm that the certificate assigned to IIS matches the renewed certificate thumbprint.

You should also verify if IIS is presenting the renewed certificate to clients. To do that, open OWA/ECP in a browser and inspect the certificate details to confirm that the expected thumbprint and expiration date are shown.

Verify Load Balancers and Reverse Proxies

If your Exchange environment is published through a load balancer, reverse proxy, or SSL offloading device, you need to ensure that the renewed certificate has also been installed on those systems. Otherwise, clients may continue to receive the old certificate even though the Exchange server has been updated successfully.

This applies to solutions such as F5 BIG-IP, Citrix ADC (NetScaler), Kemp LoadMaster, HAProxy, Nginx, Azure Application Gateway, and similar devices.

In environments with load balancers, reverse proxies, or SSL offloading devices, you need to ensure that the renewed certificate has also been installed on those systems.

Verifying SMTP TLS Certificate

You need to confirm that Exchange is presenting the expected certificate during SMTP TLS negotiation:

Get-ReceiveConnector |
Select Identity,TlsCertificateName
Check Certificate Expiration

Now check if the newly installed certificate has the expected validity period:

Get-ExchangeCertificate |
Select Subject,NotBefore,NotAfter
Monitor Event Logs

Now check for certificate-related warnings/errors:

• Application Log
• System Log
• MSExchange Front End HTTP Proxy
• MSExchangeTransport

Removing the Old Certificate

Once all validation checks have completed successfully and client connectivity is confirmed, you can remove the old certificate.

In order to list installed certificates, run the command:

Get-ExchangeCertificate

And here is the command to remove the old certificate:

Remove-ExchangeCertificate -Thumbprint <old_thumbprint>

Exchange Hybrid Considerations. In case your organization uses Exchange Hybrid, you need to verify if the renewed certificate is also selected in the Hybrid Configuration Wizard and used by hybrid connectors.

Wrapping Up

Renewing an expired or expiring Exchange server certificate can be daunting, especially for first-timers. This maintenance task is critical to keep users’ devices connected without errors and secure.

Scenario	Renewal Method
Self-signed certificate on older Exchange versions	Exchange Admin Center (EAC) or PowerShell using New-ExchangeCertificate
Self-signed certificate on Exchange 2019 CU12+ or Exchange 2016 CU23+	PowerShell only
CA-issued certificate on older Exchange versions	Exchange Admin Center (EAC): Generate CSR → Submit to CA → Complete certificate request
CA-issued certificate on Exchange 2019 CU12+ or Exchange 2016 CU23+	PowerShell only

Whether your Exchange server uses a self-signed certificate or is issued by a certificate authority, the renewal process is similar. Proper planning and careful execution will go a long way in ensuring the certificate renewal goes without a hitch.