Renew an Exchange Server certificate (original) (raw)

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Renew an Exchange Server certificate

Article
03/21/2023

Every certificate has a built-in expiration date. In Exchange Server, the default self-signed certificate that's installed on the Exchange server expires 5 years after Exchange was installed on the server. You can use the Exchange admin center (EAC) or the Exchange Management Shell to renew Exchange certificates. This includes Exchange self-signed certificates, and certificates that were issued by a certification authority (CA).

Note

The certificate management tasks are removed from EAC for Exchange Server 2016 CU23 and Exchange Server 2019 CU12. Use Exchange Management Shell procedure to export/import the certificate from these versions.

What do you need to know before you begin?

Estimated time to complete: 5 minutes
To learn how to open the Exchange Management Shell in your on-premises Exchange organization, see Open the Exchange Management Shell.
For certificates that were issued by a CA, verify the certificate request requirements of the CA. Exchange generates a PKCS #10 request (.req) file that uses Base64 encoding (default) or Distinguished Encoding Rules (DER), with an RSA public key that's 1024, 2048 (default), or 4096 bits. Note that encoding and public key options are only available in the Exchange Management Shell.
To renew a certificate that was issued by a CA, you need to renew the certificate with the same CA that issued the certificate. If you're changing CAs, or if there's a problem with the original certificate when you try to renew it, you need to create a new certificate request (also known as a certificate signing request or CSR) for a new certificate. For more information, see Create an Exchange Server certificate request for a certification authority.
If you renew or replace a certificate that was issued by a CA on a subscribed Edge Transport server, you need to remove the old certificate, and then delete and recreate the Edge Subscription. For more information, see Edge Subscription process.
You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Client Access services security" entry in the Clients and mobile devices permissions topic.
For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts in the Exchange admin center.

Renew a certificate that was issued by a certification authority

The procedures are the same for certificates that were issued by an internal CA (for example, Active Directory Certificate Services), or a commercial CA.

To renew a certificate that was issued by a CA, you create a certificate renewal request, and then you send the request to the CA. The CA then sends you the actual certificate file that you need to install on the Exchange server. The procedure is nearly identical to that of completing a new certificate request by installing the certificate on the server. For instructions, see Complete a pending Exchange Server certificate request.

Use the EAC to create a certificate renewal request for a certification authority

Open the EAC and navigate to Servers > Certificates.
In the Select server list, select the Exchange server that holds the certificate that you want to renew.
All valid certificates have a Renew link in the details pane that's visible when you select the certificate from the list. Select the certificate that you want to renew, and then click Renew in the details pane.
On the Renew Exchange certificate page that opens, in the Save the certificate request to the following file field, enter the UNC path and filename for the new certificate renewal request file. For example, \\FileServer01\Data\ContosoCertRenewal.req. When you're finished, click OK.

The certificate request appears in the list of Exchange certificates with a status value of Pending.

Use the Exchange Management Shell to create a certificate renewal request for a certification authority

To create a new certificate renewal request for a certification authority, use the following syntax:

If you need to send the content of the certificate renewal request file to the CA, use the following syntax to create a Base64 encoded request file:

$txtrequest = Get-ExchangeCertificate -Thumbprint <Thumbprint> | New-ExchangeCertificate -GenerateRequest [-KeySize <1024 | 2048 | 4096>] [-Server <ServerIdentity>]  
[System.IO.File]::WriteAllBytes('<FilePathOrUNCPath>\<FileName>.req', [System.Text.Encoding]::Unicode.GetBytes($txtrequest))

If you need to send the certificate renewal request file to the CA, use the following syntax to create a DER encoded request file:

$binrequest = Get-ExchangeCertificate -Thumbprint <Thumbprint> | New-ExchangeCertificate -GenerateRequest -BinaryEncoded [-KeySize <1024 | 2048 | 4096>] [-Server <ServerIdentity>]  
[System.IO.File]::WriteAllBytes('<FilePathOrUNCPath>\<FileName>.pfx', $binrequest.FileData)

To find the thumbprint value of the certificate that you want to renew, run the following command:

Get-ExchangeCertificate | where {$_.Status -eq "Valid" -and <span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mrow><msub><mrow></mrow><mi mathvariant="normal">.</mi></msub><mi>I</mi><mi>s</mi><mi>S</mi><mi>e</mi><mi>l</mi><mi>f</mi><mi>S</mi><mi>i</mi><mi>g</mi><mi>n</mi><mi>e</mi><mi>d</mi><mo>−</mo><mi>e</mi><mi>q</mi></mrow><annotation encoding="application/x-tex">_.IsSelfSigned -eq </annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8889em;vertical-align:-0.1944em;"></span><span class="mord"><span></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:-0.0761em;"><span style="top:-2.55em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">.</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span><span class="mord mathnormal" style="margin-right:0.07847em;">I</span><span class="mord mathnormal">s</span><span class="mord mathnormal" style="margin-right:0.05764em;">S</span><span class="mord mathnormal">e</span><span class="mord mathnormal" style="margin-right:0.01968em;">l</span><span class="mord mathnormal" style="margin-right:0.10764em;">f</span><span class="mord mathnormal" style="margin-right:0.05764em;">S</span><span class="mord mathnormal">i</span><span class="mord mathnormal" style="margin-right:0.03588em;">g</span><span class="mord mathnormal">n</span><span class="mord mathnormal">e</span><span class="mord mathnormal">d</span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">−</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.1944em;"></span><span class="mord mathnormal">e</span><span class="mord mathnormal" style="margin-right:0.03588em;">q</span></span></span></span>false} | Format-List FriendlyName,Subject,CertificateDomains,Thumbprint,NotBefore,NotAfter

For detailed syntax and parameter information, see Get-ExchangeCertificate and New-ExchangeCertificate.

Notes:

If you don't use the KeySize parameter, the certificate request has a 2048 bit RSA public key.
If you don't use the Server parameter, the command is run the local Exchange server.

This example creates a Base64 encoded certificate renewal request for the existing certificate with the Thumbprint value 5DB9879E38E36BCB60B761E29794392B23D1C054:

$txtrequest = Get-ExchangeCertificate -Thumbprint 5DB9879E38E36BCB60B761E29794392B23D1C054 | New-ExchangeCertificate -GenerateRequest
[System.IO.File]::WriteAllBytes('\\FileServer01\Data\ContosoCertRenewal.req', [System.Text.Encoding]::Unicode.GetBytes($txtrequest))

This example creates a DER (binary) encoded certificate renewal request for the same certificate:

$binrequest = Get-ExchangeCertificate -Thumbprint <Thumbprint> | New-ExchangeCertificate -GenerateRequest -BinaryEncoded
[System.IO.File]::WriteAllBytes('\\FileServer01\Data\ContosoCertRenewal.pfx', $binrequest.FileData)

How do you know that you successfully created a certificate renewal request?

To verify that you have successfully created a certificate renewal request for a certification authority, perform either of the following steps:

In the EAC at Servers > Certificates, verify the server where you stored the certificate request is selected. The request should be in the list of certificates with the Status value Pending request.
In the Exchange Management Shell on the server where you stored the certificate request, run the following command:

Get-ExchangeCertificate | where {$_.Status -eq "PendingRequest" -and <span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mrow><msub><mrow></mrow><mi mathvariant="normal">.</mi></msub><mi>I</mi><mi>s</mi><mi>S</mi><mi>e</mi><mi>l</mi><mi>f</mi><mi>S</mi><mi>i</mi><mi>g</mi><mi>n</mi><mi>e</mi><mi>d</mi><mo>−</mo><mi>e</mi><mi>q</mi></mrow><annotation encoding="application/x-tex">_.IsSelfSigned -eq </annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8889em;vertical-align:-0.1944em;"></span><span class="mord"><span></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:-0.0761em;"><span style="top:-2.55em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">.</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span><span class="mord mathnormal" style="margin-right:0.07847em;">I</span><span class="mord mathnormal">s</span><span class="mord mathnormal" style="margin-right:0.05764em;">S</span><span class="mord mathnormal">e</span><span class="mord mathnormal" style="margin-right:0.01968em;">l</span><span class="mord mathnormal" style="margin-right:0.10764em;">f</span><span class="mord mathnormal" style="margin-right:0.05764em;">S</span><span class="mord mathnormal">i</span><span class="mord mathnormal" style="margin-right:0.03588em;">g</span><span class="mord mathnormal">n</span><span class="mord mathnormal">e</span><span class="mord mathnormal">d</span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">−</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.1944em;"></span><span class="mord mathnormal">e</span><span class="mord mathnormal" style="margin-right:0.03588em;">q</span></span></span></span>false} | Format-List FriendlyName,Subject,CertificateDomains,Thumbprint

Renew an Exchange self-signed certificate

When you renew an Exchange self-signed certificate, you're basically making a new certificate.

Use the EAC to renew an Exchange self-signed certificate

Open the EAC and navigate to Servers > Certificates.
In the Select server list, select the Exchange server that holds the certificate that you want to renew.
All valid certificates have a Renew link in the details pane that's visible when you select the certificate from the list. Select the certificate that you want to renew, and then click Renew in the details pane.
On the Renew Exchange certificate page that opens, verify the read-only list of Exchange services that the existing certificate is assigned to, and then click OK.

Use the Exchange Management Shell to renew an Exchange self-signed certificate

To renew a self-signed certificate, use the following syntax:

Get-ExchangeCertificate -Thumbprint <Thumbprint> | New-ExchangeCertificate [-Force] [-PrivateKeyExportable <$true | $false>]

To find the thumbprint value of the certificate that you want to renew, run the following command:

Get-ExchangeCertificate | where {$_.IsSelfSigned -eq $true} | Format-List FriendlyName,Subject,CertificateDomains,Thumbprint,NotBefore,NotAfter

This example renews a self-signed certificate on the local Exchange server, and uses the following settings:

The thumbprint value of the existing self-signed certificate to renew is BC37CBE2E59566BFF7D01FEAC9B6517841475F2D
The Force switch replaces the original self-signed certificate without a confirmation prompt.
The private key is exportable. This allows you to export the certificate and import it on other servers.

Get-ExchangeCertificate -Thumbprint BC37CBE2E59566BFF7D01FEAC9B6517841475F2D | New-ExchangeCertificate -Force -PrivateKeyExportable $true

How do you know that you've successfully renewed an Exchange self-signed certificate?

To verify that you have successfully renewed an Exchange self-signed certificate, use either of the following procedures:

In the EAC at Servers > Certificates, verify the server where you installed the certificate is selected. In the list of certificates, verify that the certificate has Status property value Valid.
In the Exchange Management Shell on the server where you renewed the self-signed certificate, run the following command to verify the property values:

Get-ExchangeCertificate | where {$_.Status -eq "Valid" -and <span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mrow><msub><mrow></mrow><mi mathvariant="normal">.</mi></msub><mi>I</mi><mi>s</mi><mi>S</mi><mi>e</mi><mi>l</mi><mi>f</mi><mi>S</mi><mi>i</mi><mi>g</mi><mi>n</mi><mi>e</mi><mi>d</mi><mo>−</mo><mi>e</mi><mi>q</mi></mrow><annotation encoding="application/x-tex">_.IsSelfSigned -eq </annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8889em;vertical-align:-0.1944em;"></span><span class="mord"><span></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:-0.0761em;"><span style="top:-2.55em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">.</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span><span class="mord mathnormal" style="margin-right:0.07847em;">I</span><span class="mord mathnormal">s</span><span class="mord mathnormal" style="margin-right:0.05764em;">S</span><span class="mord mathnormal">e</span><span class="mord mathnormal" style="margin-right:0.01968em;">l</span><span class="mord mathnormal" style="margin-right:0.10764em;">f</span><span class="mord mathnormal" style="margin-right:0.05764em;">S</span><span class="mord mathnormal">i</span><span class="mord mathnormal" style="margin-right:0.03588em;">g</span><span class="mord mathnormal">n</span><span class="mord mathnormal">e</span><span class="mord mathnormal">d</span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">−</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.1944em;"></span><span class="mord mathnormal">e</span><span class="mord mathnormal" style="margin-right:0.03588em;">q</span></span></span></span>true} | Format-List FriendlyName,Subject,CertificateDomains,Thumbprint,NotBefore,NotAfter

Important

Removing, renewing, or assigning services to the certificate can remove the certificate from Exchange Back End and Default Web Site. It's essential that you check the certificate bindings and apply the correct certificates.

Additional resources

Unable to open OWA, ECP, or EMS after a self-signed certificate is removed from the Exchange Back End website

Renew an Exchange Server certificate (original) (raw)