Solved

how do i renew a self signed cert in exchange 2007?

Posted on 2011-02-15
7
500 Views
Last Modified: 2012-05-11
We run exchange 2007 here and use a self signed certificate. I am running into trouble renewing the certificate, installing it, and exporting it for use on our windows mobile devices so we can get email on our devices. If anyone has done this before I would appreciate it.
0
Comment
Question by:Jryals8900
  • 4
7 Comments
 
LVL 1

Accepted Solution

by:
dbllp earned 500 total points
ID: 34900341
To renew the certificate for server server.network.com, a server with CAS and HT roles installed:

Get-ExchangeCertificate -domain “server.network.com” | fl

Note the services the certificate is enabled for (by default: POP, IMAP, IIS, SMTP on CAS + HT servers). Copy the thumbprint of the certificate.

Get a new certificate with a new expiration date:

Get-ExchangeCertificate -thumbprint “C5DD5B60949267AD624618D8492C4C5281FDD10F” | New-ExchangeCertificate

To create a new certificate with an exportable private key, use the PrivateKeyExportable parameter. For example:
New-ExchangeCertificate -PrivateKeyExportable $true
If the existing certificate is being used as the default SMTP certificate, you will get the following prompt. The default SMTP certificate is used to encrypt SMTP sessions between transport servers in your organization.

Type y to continue. A new certificate is generated.

The new certificate is generated and enabled. Examine the new certificate:

Get-ExchangeCertificate -thumbprint “3DA55740509DBA19D1A43A9C7161ED2D0B3B9E3E” | fl

The old certificate is enabled for IIS, POP, IMAP and SMTP. The new certificate generated using the above command is enabled only for POP, IMAP and SMTP – IIS is missing.

You can enable the certificate for IIS (in addition to any other services it may already be enabled for — it adds to existing values of the certificate’s Services property).

Note: Once you enable a certificate for a particular Exchange Server service, there’s no way to disable it (for that service). You must remove the certificate (if the certificate is CA-issued, export the certificate along with its private key before you do so), import it again and enable it for the services you need to. This is generally not a concern with self-signed certificates— you can generate additional self-signed certificates and optionally remove the old one, since there’s no CA interaction or costs involved.

Setting the Services parameter to None does not do anything in this case.

To enable the certificate for IIS:

Enable-ExchangeCertificate -thumbprint “3DA55740509DBA19D1A43A9C7161ED2D0B3B9E3E” -services IIS

 Test services are working with the new certificate. If it works as expected, the old certificate can be removed:

Remove-ExchangeCertificate -thumbprint “C5DD5B60949267AD624618D8492C4C5281FDD10F”

Obviously you will have the use the thumbprints from your system, mine are just examples.
0
 

Author Comment

by:Jryals8900
ID: 34900442
and how do you export it??
0
 
LVL 1

Assisted Solution

by:dbllp
dbllp earned 500 total points
ID: 34900472
Export-ExchangeCertificate -Thumbprint <String> [-BinaryEncoded <SwitchParameter>] [-Confirm [<SwitchParameter>]] [-DomainController <Fqdn>] [-Force <SwitchParameter>] [-Password <SecureString>] [-Path <String>] [-WhatIf [<SwitchParameter>]]
0
 
LVL 1

Expert Comment

by:dbllp
ID: 34900483
you only need to specify thumbprint and path.. .for path it should be like c:\certificate.pfx

but you can name it whatever, it should end in pfx if you plan to use it on devices.
0
 
LVL 1

Expert Comment

by:dbllp
ID: 34907657
sorry about that... just reposting a valid answer..

didnt think it was plagerism...as I could have typed all that out myself but why reinvent the wheel.

wont happen again... i will just type everything out myself in the future.
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now