0

Exchange [EMC] View of certs

  1. Name: Blank
  2. Self Signed: False
  3. Status: The cert is valid for exchange server usage
  4. Services: None
  5. Subject: CN=Servername.domain.local
  6. Issuer: CN=Domain-servername-CA
  7. Expiration Date: 05/05/2015

IIS view of cert

  1. Name: blank
  2. Issued To: Servername.domain.local
  3. Issued By: domain-servername-CA
  4. Expiration Date: 05/05/2015
  5. Certificate Hash: h#^$$................................*****

Note: I tried renewing it by generating a renewal request from exchange emc and using internal Ca "/loalhost/certsrv" to continue the request process and coming back to exchange to complete the renewal request it does complete the request but some how it creates/renews a different cert like this

Exchange [EMC] View of certs

  1. Name: Blank
  2. Self Signed: False
  3. Status: The cert is valid for exchange server usage
  4. Services: SMTP
  5. Subject: CN=Servername.externaldomain.com
  6. Issuer: CN=Domain-servername-CA
  7. Expiration Date: 05/05/2015

What am I missing?

  • You lost me on the 2nd half...yes you can remove a cert that isn't being used by any Exchange service, but you are stating that it is still in use? Are the thumbprints the same? Sure you don't have multiple in PS? – TheCleaner Jan 24 '14 at 17:12
  • May alternative question will be is there a different method to renew a servername.domain.local certificate issued by local cert authority? and why is my above method of renewal turning a domain.local cert renewal to domain.com with smtp [which I didn't assign or specify] – zman Jan 24 '14 at 18:40
  • Also tried this Get-ExchangeCertificate -Thumbprint "copiedthumbprinthere" | new-ExchangeCertificate -Geta a warning: this certificate will not be used for external TLS connection with an FQDN of "server.domain.local" because ca-signed certificate with thumbprint ********* takes precedence. The following receive/send connector match that FQDN: servername -Confirm-Overwrite the existing default SMTP certificate? [Y] [A] etc – zman Jan 24 '14 at 19:14
0

There must be some type of bug in renewing cert via GUI as It was creating a different type both from exchange EMC and IIS. I tried following steps after I was unable to renew certificate authority Issued certificate renewal via exchange and IIS.

  1. Open Exchange Shell
  2. Type following command to identify the correct cert by thumbprint Get-ExchangeCertificate
  3. Next line Get-ExchangeCertificate -Thumbprint '5****PickthecorrectThumbprintC5' | New-ExchangeCertificate -GenerateRequest -PrivateKeyExportable $true

    -Note you can copy paste thumbprint

  4. copy the generated certificate request starting with 5x ----- and ending with 5x -----to your certsrv

  5. Click request a Certficate > advance certificate request>paste the cert request > click submit

  6. Download the .cer file

  7. Open IIS select the certificate you want to renew

  8. Righ click > Renew > Complete certificate renewal request > browse the that .cer file >click next and finish

  9. Viola ... You have the exact certificate renewed

  • didn't feel comfortable deleting the cert which wasn't associate with any other service so decided to renew it – zman Jan 24 '14 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.