Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have been using an Exchange 2010 mail server for a year now. Today the certificates used in Exchange, as well as of Forefront TMG expired.

We had the following certificate chain: Root CA issued a sub CA a certificate that has expired today as well.

SubCA issued a whole bunch of certificates (in the issued list), but from what I understand, the main is CSPO and CA certificate.

I have access to all servers in pay for mailflow: RootCA, SubCA, Exchange, Forefront.

What will be the outline of actions I need to take, to get back the mail running?

Thank you.

share|improve this question
up vote 1 down vote accepted

I ended up figuring out the solution myself.

The steps I needed to take are:

  1. Request a new CA certificate for SubCA from a RootCA.
  2. Renew the OCSP certificate for OCSP Responders to work properly

    certutil -setreg ca\UseDefinedCACertInRequest 1

  3. Renew the Exhcange server certificate by:

a) Creating a renew request on an expired certificate in EMC. Result -> *.req file. b) Copy the req file to a SubCA. c) Run the following command on SubCA

certreq -submit -attrib "CertificateTemplate: WebServer" myreqfilename

Result -> *.cer file generated.

d) copy the cer file to EMC computer and use it to finish the new certificate enrollment request.

  1. Assign POP, IMAP, SMTP and IIS services to this certificate in EMC
  2. Export this renewed certificate with a private key in EMC. Result -> *.pfx file.
  3. Import the pfx into the Local Machine personal certificate store on Forefront TMG
  4. Assign a new certificate to all OWA publishing rules.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.