Exchange

If you have multiple Exchange servers, it is imperative that each server have a valid 3rd-party certificate reflecting the namespace. If you don’t, some client connections will get certificate errors.

In our example below, we have two Exchange 2016 servers behind a load balancer in a single site; EX16-01 and EX16-02. Our third-party certificate request was generated and completed on EX16-01. We have also assigned services to that certificate. However, that certificate does not yet exist on EX16-02. Only the default out-of-the-box certificates exist on EX16-02.

When user Amy Pond connects, she is load balanced to EX16-01, which has a 3rd party certificate. The certificate matches the namespace. Her connection is established without error. On the other hand, when Rory Williams connects, he is load balanced to EX16-02. EX16-02 returns its self-signed certificate. This certificate does not match the namespace. Rory receives a security error.

In this article, we explore transferring a third-party SSL certificate from one Exchange server to another.

We explore this process through both the Exchange Admin Center and PowerShell.

Let’s get started!

Note: These steps are identical for Exchange 2013, Exchange 2016 CU22 and earlier, and Exchange 2019 CU11 and earlier. If you are using Exchange 2016 CU23 or greater or Exchange 2019 CU12 or greater, you must renew your certificate with all new PowerShell commands covered in the following article.

Export the certificate with Exchange Admin Center

Log in to the Exchange Admin Center. It doesn’t have to be the server you created your request on.

Navigate to the Servers tab and Certificates sub-tab.

In the Select Server drop-down, pick the server you completed the certificate request on. In our example, this was EX16-01.

In previous articles, we generated and completed a certificate request. Keep in mind that despite the request being completed, it is not yet live. We must still assign services to that certificate.

In this article, we will assign services to a certificate (affiliate) in Exchange 2016. We explore how to accomplish this using the Exchange Admin Center and PowerShell.

Let’s get started!

Note: The Exchange Admin Center steps to assign services to certificates are identical for Exchange 2013, Exchange 2016, and Exchange 2019. If you are using Exchange 2016 CU23 or greater or Exchange 2019 CU12 or greater, and you wish to use PowerShell, check this article for the updated commands.

Assign Services to a Certificate with Exchange Admin Center

Log in to the Exchange Admin Center (EAC). Select the Servers tab and Certificates sub-tab.

Select your certificate and click the Edit () button.

In a previous article, we examined the process of generating a certificate request for Exchange 2016. We then submitted that request to a certificate provider. Now that the certificate provider has validated our identity and issued our certificate, we are ready to move on to the next step.

In this article, we complete our certificate request. We explore how to accomplish this using the Exchange Admin Center and PowerShell.

Let’s get started!

Note: These steps are identical for Exchange 2013, Exchange 2016 CU22 and earlier, and Exchange 2019 CU11 and earlier. If you are using Exchange 2016 CU23 or greater or Exchange 2019 CU12 or greater, you must complete your pending certificate request with all new PowerShell commands covered in the following article.

Complete a Certificate Request with Exchange Admin Center

Log in to the Exchange Admin Center (EAC). Select the Servers tab and Certificates sub-tab.

Select your pending certificate request and click the Complete link from the action pane.

In this article, we examine the process of generating a certificate request for Exchange 2016. We explore how to accomplish this using the Exchange Admin Center and PowerShell.

In future articles, we will explore completing that request, assigning services to the certificate, and importing that certificate to other Exchange servers.

Let’s get started!

Note: These steps are identical for Exchange 2013, Exchange 2016 CU22 and earlier, and Exchange 2019 CU11 and earlier. If you are using Exchange 2016 CU23 or greater or Exchange 2019 CU12 or greater, you must generate your certificate with all new PowerShell commands covered in the following article.

Generate a Certificate Request with Exchange Admin Center

Log in to the Exchange Admin Center (EAC). Select the Servers tab and Certificates subtab.

This page displays all currently installed Exchange certificates. These three self-signed certificates are installed with Exchange out of the box. The self-signed certificate titled “Microsoft Exchange” is the one that Exchange is currently using for all of its web services. That’s the one that we will replace with a trusted 3rd party certificate.

Like its predecessor, Exchange 2016 maintains the Certificate Request Wizard. This wizard takes all the guesswork out of generating a certificate request.

To launch the wizard click the New (+) button.

In the New Exchange Certificate wizard, select Create a request for a certificate from a certification authority. Click Next.