A step-by-step Guide on how to renew an Exchange certificate in 7 steps

This guide is for Exchange Server administrators who need to renew SSL certificates for their organization’s email infrastructure.

Certificate renewal is a regular task you can’t ignore. When certificates expire, your users lose access to email services. Email clients throw security warnings. Mobile devices stop syncing. Your entire communication system grinds to a halt.

Starting with Exchange Server 2019 CU11, Microsoft removed certificate renewal from the Exchange Admin Center (ECP) web interface. The Exchange Management Shell is now the only supported method. This might sound intimidating, but it is straightforward once you know the steps.

This complete tutorial walks you through renewing your Exchange certificate using PowerShell commands. You will learn to create a certificate signing request, work with a certification authority, and bind your new certificate to Exchange services, all without downtime.

Who This Guide Is For:

• Exchange Server administrators managing on-premises email infrastructure
• IT professionals responsible for certificate management and security compliance
• System administrators who need to renew certificates before expiration
• MSPs (Managed Service Providers) handling Exchange servers for multiple clients

Who This Guide Is NOT For:

If you’re running Exchange Online (Microsoft 365), you don’t need this guide. Microsoft handles all certificate management automatically for cloud-based Exchange. This tutorial is specifically designed for administrators of on-premises Exchange Server 2019 (CU11 or later).

This guide also covers the public certificate that secures OWA, ActiveSync and SMTP. It is not about the Microsoft Exchange Server Auth Certificate, which is a different certificate entirely. See the FAQ at the end for the difference.

My certificate authority provider, ssls.com will only issue a certificate for one year, but I paid for three years. If you still have the certificate request file from last year, creating a new one is unnecessary. In that case, you can skip steps 1 and 2.

Step 1 – Find the certificate thumbprint

Find out what the thumbprint is of the certificate you need to renew. Run this in the Exchange Management Shell:

Get-ExchangeCertificate | where {$_.Status -eq "Valid" -and $_.IsSelfSigned -eq $false} | Format-List FriendlyName,Subject,CertificateDomains,Thumbprint,NotBefore,NotAfter

The filter on IsSelfSigned -eq $false matters. It hides the Exchange self signed certificates so you only see the third party certificate you actually want to replace.

Copy the thumbprint value. You need it in the next step.

Step 2 – Create a certificate signing request

Create a certificate signing request (CSR) and save it on the local drive. This is the file your certification authority needs.

$txtrequest = Get-ExchangeCertificate -Thumbprint 1C002FCFD9F1EFAEB30B288A631BDACD47BA0F47 | New-ExchangeCertificate -GenerateRequest
[System.IO.File]::WriteAllBytes('C:CertsCert2023CertRenewal.req', [System.Text.Encoding]::Unicode.GetBytes($txtrequest))

Replace the thumbprint with your own, and adjust the path to a folder that already exists.

Because you piped an existing certificate into New-ExchangeCertificate, the request inherits the subject and all the domain names of the old certificate. That saves you retyping them.

You should get a CertRenewal.req file at the location specified. Open it with Notepad and you will see the begin and end lines of a new certificate request. Your provider will ask you to paste the entire contents, including those lines.

The new certificate now shows up as a pending request when you run Get-ExchangeCertificate. That is expected. It stays pending until you complete the renewal in step 7.

Step 3 – Buy from a certification authority

Buy an SSL certificate from your authority provider. I’m using SSLs.com for my Exchange Server 2019 certificate. As part of the process, you can choose which web server the certificate should be processed for. Choose Windows Server or IIS.

Ensure you receive a .pfx file from your authority provider. If this is impossible, convert the bundle you receive to a .pfx file containing the private key.

First, you will be asked for the CSR, CertRenewal.req in my example, and then you will receive the private key. It is important to save it in a text file, such as Notepad. It starts with —–BEGIN PRIVATE KEY—–

Step 4 – Domain verification

The SSL authority provider will request domain verification. Usually, there are two ways: by email or TXT DNS record. It’s up to you what you choose. I like using the email verification process.

I bought a Positive SSL certificate for multiple domains. I received a verification email for each domain. All I had to do was to visit the website specified in the verification email and paste the verification code. I bought the certificate for three domains, so I received three emails.

Usually, you cannot choose which email address you want to get the verification email sent to. In my case, some email IDs with the domain were suggested. Normally, there are hostmaster@, webmaster@, or admin@. Since I’m an Exchange administrator, I add the email address to my normal email ID as an alias. A simple solution. 🙂

After completing the verification process, you will receive an email with the certificate as a ZIP file.

• STAR.bns.legal.ca-bundle: This file contains intermediate certificates establishing the trust chain between your SSL certificate and the Certificate Authority’s root certificate.
• STAR.bns.legal.crt: This is your primary SSL certificate for the domain
• STAR.bns.legal.p7b: This PKCS#7 file typically includes the certificate chain (similar to .crt), but it doesn’t include the private key.

Since these files don’t include the private key, you’ll need to use the private key you used in step 3 when you created the certificate signing request.

Optional – Build the .pfx file yourself with OpenSSL

If you have not received a .pfx file from your certificate authority, you need to create one that contains the private key as well. A good tool is OpenSSL for Windows, which you can download from here.

Use OpenSSL to combine your primary certificate (STAR.bns.legal.crt), the CA bundle (STAR.bns.legal.ca-bundle), and your private key:

openssl pkcs12 -export -out STAR.bns.legal.pfx -inkey STAR.bns.legal.key -in STAR.bns.legal.crt -certfile STAR.bns.legal.ca-bundle

My example is STAR.bns.legal.key, the private key I saved in step 3.

You will be prompted to set a password to protect the .pfx file. This password will be required when importing the .pfx file into services like IIS or Exchange.

Step 5 – Import into the Windows certificate store

Copy the .pfx file to the Exchange Server. It’s time to import the certificate to the certificate store. Type ‘certmgr’ in the Windows search field and start ‘manage computer certificates’.

If you prefer the Microsoft Management Console, run mmc, add the Certificates snap in, and select computer account when it asks.

Right-click the certificate under Personal, and click ‘All Tasks’> ‘ Import ‘. Store Location is ‘Local Machine’. Browse to the location where you have saved the extracted certificate and import the .pfx file.

The certificate should appear in the right pane. I recommend assigning a ‘friendly name’ to the certificate, but this is optional. Right-click the certificate and choose Properties.

Step 6 – Bind to the Default Web Site

Bind the new certificate to IIS. Start IIS manager, select ‘Default Web site’, then Bindings.

Leave the Exchange Back End site alone. It keeps its own self signed certificate on port 444, and swapping it for your public certificate breaks things.

Step 7 (Last) – Import into Exchange and assign services

Import the .pfx file into Microsoft Exchange:

Import-ExchangeCertificate -FileData ([System.IO.File]::ReadAllBytes('C:SSL2024STAR.bns.legal.pfx')) -Password (ConvertTo-SecureString -String '1234' -AsPlainText -Force)

In my example, I chose a simple password, “1234”. Use something better.

Now enable the Exchange services for the new certificate:

Enable-ExchangeCertificate -Server "notos.bns.legal" -Thumbprint "use the thumbprint of the certificate" -Services SMTP,IIS -Force

SMTP and IIS are, in most cases, fine unless you use IMAP and POP3, too.

Exchange will ask whether you want to overwrite the existing default SMTP certificate. Answer yes, otherwise mail flow keeps using the old certificate.

Verify the assignment of the services:

Get-ExchangeCertificate | Format-List FriendlyName, Subject, Services, Thumbprint, NotBefore, NotAfter

Restart IIS and restart the ‘Microsoft Exchange Transport’ service. If you can restart the server, even better.

The new certificate should appear in the Exchange Admin Center (ECP) with the friendly name you gave it. It’s all done!

Remove the old certificate

Do not skip this. An expired certificate left in the store causes confusing certificate errors months later, and it makes the next renewal harder because you cannot tell the old cert from the new one.

Wait until the new certificate is working. Check OWA in a browser, send a test message, and confirm Outlook connects without a warning. Then list the certificates again and find the old thumbprint:

Get-ExchangeCertificate | Format-List FriendlyName,Subject,Services,Thumbprint,NotAfter

Confirm the old certificate no longer has any services assigned. If the Services column still shows IIS or SMTP, go back and finish step 7 first.

Then remove it:

Remove-ExchangeCertificate -Thumbprint "old thumbprint value"

If you are unable to delete the certificate, it is almost always because a service is still bound to it. Check the IIS certificate bindings and the Exchange services.

Renewing an Exchange self-signed certificate

Everything above assumes a third-party certificate from a public certification authority. Exchange also creates self-signed certificates during setup, and those expire too.

A self signed cert needs no CSR and no provider. You renew it in one command:

Get-ExchangeCertificate -Thumbprint "thumbprint value" | New-ExchangeCertificate

Exchange creates a new self signed certificate with the same subject, and asks whether to replace the existing default SMTP certificate.

The same applies to a certificate issued by an internal CA, except there you still submit a request to your own certification authority rather than buying one.

Clients outside your organization will not trust a self signed cert, which is exactly why you buy a third party certificate for anything facing the internet.

More than one server, or a hybrid environment

If you run other Exchange servers, the certificate has to go on each one. The same .pfx works everywhere. Copy it across, import it, and run Enable-ExchangeCertificate on each server with that server’s name. The thumbprint is the same on all of them.

In a hybrid environment there is one extra step. The hybrid configuration references the certificate for secure mail flow with Exchange Online. After you replace it, re-run the Hybrid Configuration Wizard so the connectors pick up the new certificate. Skipping this is a common cause of hybrid mail flow breaking a few days after a renewal that otherwise looked fine.

Plan either of these inside a maintenance window. Restarting IIS on a live server drops client connections.

Automate the renewal with Let’s Encrypt

Everything above is the commercial certificate route, and it comes round every year. On my homelab Exchange server, I stopped doing it by hand.

Let’s Encrypt issues free certificates through the ACME protocol. They last 90 days, which sounds worse until you automate it. I use win-acme. It requests the certificate, installs it, updates the IIS binding, and re-runs the Exchange service assignment after every renewal. I set it up once and have not touched it since. Set and forget is the honest description.

It does not suit every environment:

• Domain validated only. There is no OV or EV option, which some organizations require.
• Validation needs port 80 reachable from the internet for an HTTP-01 challenge, or a DNS-01 challenge if you want a wildcard.
• The failure mode is quiet. If the scheduled task stops running, you won’t be notified until the certificate expires. Keep an expiry check in your monitoring.

For a homelab or a small business server where no one is auditing which certificate authority you use, it removes an annual chore. For a regulated environment, stay with a commercial certificate and the steps above.

Frequently Asked Questions

How do I renew my Exchange Auth certificate?

That is a different certificate. The Microsoft Exchange Server Auth Certificate is a self signed certificate that Exchange uses internally for OAuth and server to server authentication, and it has nothing to do with the public certificate this guide covers. You renew it with New-ExchangeCertificate and then point the auth configuration at the new thumbprint with Set-AuthConfig, followed by a publish step. It deserves its own guide, because getting the order wrong breaks hybrid and Teams integration.

How do I renew an expired certificate?

The same way as one that has not expired yet. Expiry does not block the renewal, it just means your users are already seeing warnings. Work through the steps above, and remember that the certification authority still has to verify your domains, which can take a few hours.

How do I know which certificate to renew?

Run Get-ExchangeCertificate and look at the Services column. The certificate with IIS and SMTP assigned is the one securing OWA, ActiveSync and mail flow. That is the one to renew.

Can I still renew a certificate in the Exchange Admin Center?

Not from Exchange Server 2019 CU11 onwards. Microsoft removed the certificate management interface from the EAC, so the Exchange Management Shell is the supported route. Older builds still have the GUI option.

Final Thoughts

Many Exchange tasks are performed today by PowerShell. The WebUI ECP is only for simple ,tasks such as creating or modifying a user mailbox. See also my separate article about giving mailbox permission using PowerShell. It is much easier than visiting the user’s desk and doing it manually in Outlook.

Put a reminder in your calendar a month before the new certificate expires. Renewal is a calm job when you plan it and a bad afternoon when you do not.

I have created a health checklist for Exchange Server that may be useful for your work. It reports certificate expiry dates for every server in one pass, which is the easiest way to catch the next renewal early.

I’d love to hear from you. Was this article helpful? Share your thoughts in the comments below. If you prefer, you can also reach me by email or connect with me on Reddit at Navigatetech.

Related Articles

• Exchange Server Health Check with PowerShell
• Exchange Server in Maintenance Mode
• Exchange setup fails with a certificate error
• Set-Mailbox Permissions