SBS 2011 Certificate Confusion - Expired, but not really

I had several "Expired Certificate" messages come up in the server's event logs, so I used the "Fix my network" wizard to try and address them. The new certificates were created, but the errors persisted. I went into Administrative tools > Certificate Authority and 'revoked' the expired certificates. The errors continued. I went into IIS > [server] > Sites, right-clicked on Default Web Site, and selected Edit Bindings. I scrolled down to https|443|* and clicked the Edit button. In the SSL certificate section (with the "remote.[server].com" site), I clicked the View button. It listed the expired certificate. Back in the Edit Site Binding window. I clicked on the drop-down arrow for the SSL certificate and chose a different "remote.[server].com" site. When I checked "View" it now had the correct, up-to-date certificate. This solved the certificate error messages that Outlook users were getting, but the expired certificate errors still showed up in the server's event logs. I'm at a loss as to what to do next to get rid of them. Help!
Bassman20122Support TechnicianAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Simon Butler (Sembee)ConsultantCommented:
Your mistake was using the tools that you did to remove the expired certificates - you haven't actually removed them.

Start Exchange Management Console, then click on Server Config. Choose your server and in the lower box will be certificates. Remove all of the expired certificates. You should be left with two:

A certificate called Exchange with just the SMTP service enabled.
The certificate used by SBS with everything else enabled.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Bassman20122Support TechnicianAuthor Commented:
Hi Simon,

One certificate was removed without incident. However, when I try to remove the other expired certificate I get a message that says, "Error: The internal transport certificate cannot be removed because that would cause the Microsoft Exchange Transport service to stop. To replace the internal transport certificate, create a new certificate. The new certificate will automatically become the internal transport certificate. You can then remove the existing certificate." I thought the "Fix my network" wizard was supposed to have done this.

Simon Butler (Sembee)ConsultantCommented:
Fix my Network doesn't always replace the default certificate that Exchange wants to use.
Start EMS, then run


no additional prompts.
When you get asked about replacing the default SMTP certificate, say YES to that prompt.
Then restart Transport. You should then be able to remove the expired certificate.

Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

Bassman20122Support TechnicianAuthor Commented:
I also noticed that when I right clicked on the expired certificate, I had the option to Renew the Expired Certificate. I tried that and, after going through the steps, ended up with a "pending certificate signing request (CSR)" in the list of certificates. When I right clicked on that, it opened a Complete Pending Request wizard. It was asking me to Browse to "Select a certificate to map to this certificate request." This is supposed to be a self-signed certificate, so I'm not sure where I should browse to.
Bassman20122Support TechnicianAuthor Commented:
I saw you second post right after I sent my last message. Sorry.
Simon Butler (Sembee)ConsultantCommented:
You can delete the pending certificate request.

Bassman20122Support TechnicianAuthor Commented:
Thanks Simon,

I suspect your suggestions will solve the problem. I haven't been able to implement them as yet. Other projects are interfering and email is flowing. The errors are more annoying than critical. I will let you know how things turn out.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.