Expired Exchange 2013 SSL Certificate Still Active Despite attempts to remove it
I have a exchange 2013 server running on server 2012. The SSL certificate from Comodo expired two days ago. We purchased a 3 year multi site certificate from Godaddy. I went through the process of creating the CSR, putting that into Godaddy's CSR request entry form and have received my certificate. I installed the intermediary certificate and see Godaddy certificate there.
I then go to EAC and complete the CSR and import the certificate. I then assigned the services IIS, SMTP, POP, IMAP to the certificate.
I have also looked at IIS manager to verify that IIS is using the correct certificate. The bindings.
However, when I go to the web site for our OWA, the old expired certificate is still there. I have been fighting with this for 12 hours now and would appreciate any help I can get.
Scott
I then go to EAC and complete the CSR and import the certificate. I then assigned the services IIS, SMTP, POP, IMAP to the certificate.
I have also looked at IIS manager to verify that IIS is using the correct certificate. The bindings.
However, when I go to the web site for our OWA, the old expired certificate is still there. I have been fighting with this for 12 hours now and would appreciate any help I can get.
Scott
--> When I go to the web site for our OWA,
Do you mean in IIS?
You can delete the expired certificate.
Remove-Exchangecertificate
Do you mean in IIS?
You can delete the expired certificate.
Remove-Exchangecertificate
Open up MMC and the certificates snap-in and browse to the cert you just installed. Does the cert icon have a key on it?
Yes. The new certificate has a Key. It says You have a private key that corresponds to this certificate.
consolecrts.png
Certificate.png
consolecrts.png
Certificate.png
Yes. When I say OWA I do mean that I am actually hitting IIS.
How do I determine what the thumbprint is for "You can delete the expired certificate.
Remove-Exchangecertificate
How do I determine what the thumbprint is for "You can delete the expired certificate.
Remove-Exchangecertificate
Ok, I understand what you need to do.
Right now your certificate is the expired one.
So, you need to set the new one.
![certificate-expired.png]()
1st try "IISRESET"
If it doesn't take the new cert, then assign it again. The whole procedure is the one I'll point out now:
Step1 Run
![sss.png]()
you will get all the certificates, and it's validity period (goes from NotBefore datetime to notAfter datetime)
Those that are expired you can remove it using its thumbprint but do not delete the one called "federation"
Select the thumbprint of the new cert. Then run
Then go to IIS.
look in the Backend site and go to bindings and select the new certificate
then go back to PowerShell and run IISRESET (to reset the IIS).
Right now your certificate is the expired one.
So, you need to set the new one.
1st try "IISRESET"If it doesn't take the new cert, then assign it again. The whole procedure is the one I'll point out now:
Step1 Run
Get-ExchangeCertificate | select Thumbprint,subject,services,not*
you will get all the certificates, and it's validity period (goes from NotBefore datetime to notAfter datetime)Those that are expired you can remove it using its thumbprint but do not delete the one called "federation"
Select the thumbprint of the new cert. Then run
Enable-ExchangeCertificate -Thumbprint XXXX -Services IIS,SMTP
Then go to IIS.
look in the Backend site and go to bindings and select the new certificate
then go back to PowerShell and run IISRESET (to reset the IIS).
1st logon to webmail from exchange server and check which certificate its showing in padlock?
If its new, just clear browser cache on workstation and check
If its new, just clear browser cache on workstation and check
You can determine using this command. This will list you all certificates with subject,issuer and expiry date
Jose gave you the command(above) to enable services on the right certificate.
Get-ExchangeCertificate | fl issuer,subject,NotAfter
Jose gave you the command(above) to enable services on the right certificate.
Did you bind all your email address hosts under Default Web Site in ISS to new cert on port 443 ?
All I mean:
email.yourdomain.com
autodiscover.yourdomain.co
email.yourdomain.local
All I mean:
email.yourdomain.com
autodiscover.yourdomain.co
email.yourdomain.local
https://www.ssllabs.com/ss
So please update this question with whether your problem remains or has been resolved.
Also, you have correct coverage setup for your cert....
So please update this question with whether your problem remains or has been resolved.
Also, you have correct coverage setup for your cert....
imac> echo QUIT | openssl s_client -connect troycapital.com:443 -servername troycapital.com 2>&1 | openssl x509 -noout -text | grep DNS:
DNS:troycapital.com, DNS:www.troycapital.com
Thanks to everybody. We were really close based on the support you gave me. At 12 midnight, I contacted Microsoft and got help from them that cleared it. I couldn't afford for the client to go into the next day not having emails, etc. There were minor things that MS tech did to get us back online.
Thank you. Again. Scott
Thank you. Again. Scott
Premium Content
You need an Expert Office subscription to comment.Start Free Trial