According to the MSDN article Renew an Exchange Certificate, I'm supposed to use
Get-ExchangeCertificate -Thumbprint 'AD19B141228C7CF98B5F78DCED978B7C45E15434' | New-ExchangeCertificate -GenerateRequest -PrivateKeyExportable $true
This will generate a CSR for me, which I send to our SSL certificate reseller through their SSL certificate renewal website. That site then promptly returns the following error:
 CSR Country code invalid
Which isn't surprising, because the CSR doesn't contain any country code as far as I can tell.
In the past years, I've just bought a new certificate and replaced the old one. But I'd really like to understand what's going wrong with this renewal process.