Read time 6 minutes
An SSL certificate installed on the Exchange Server is the foundational step for securing your email messages. The SSL certificate protects your professional communication, authenticates your identity to the receiver, and saves you from potential hacker or malware attack. But it does not come inbuilt with the Exchange Server, and so users have to buy it from authorized security certificate vendors and use it in the Exchange.
It follows a step-by-step process to generate an SSL certificate request file within the Exchange Server at the Exchange admin center, and later you can use this file on the vendor’s website to mention your organization details.
Pre-requisites for Generating a CSR in Exchange Server 2016
Before you proceed to follow the process to generate the SSL certificate, here are the necessary prerequisites:
- Prepare the list of domain names (Outlook on the Web, Autodiscover, ActiveSync, Outlook Anywhere) to connect email client to Exchange services.
- Gather all the organization details (common name, registered organization name, department, city, province, and country) that you’ll need to submit the request.
- You’ll need to provide a path to store CSR file, for which sharing and other security permissions will be needed. Make sure you’ve access to copy the CSR text.
- You must be a member of the given role groups:
- Organization Management
- Server Management
- Try avoiding the use of characters like > < ! @ # $ % ^ * ( ) ~ ? / \. & in the Exchange Management Shell.
Steps to Generate CSR from the Exchange Admin Center
SSL certificates are managed in Exchange Server from Servers > certificates in the Exchange admin center. Here is how you can generate an SSL certificate request:
- Login to Exchange Admin Center.
- Go to the Servers category, then click Certificates.
- Choose the first option to ‘create a request for a certificate from a certification authority.’ Click Next.
- Provide a descriptive name to the certificate. Then click Next.
- When you get the option to input a request for a wildcard certificate, then you have three scenarios to consider:
- If you require the wildcard certificate, then input the wildcard character (*) and the root domain name. For example, *.testdomain.com.
- If you require a subject alternative name (SAN) certificate, then skip the option.
- If you require the certificate for the single domain or host, then skip the option.
- Click Next.
- Click the Browse button and select the Exchange Server for which you want to get the SSL certificate. Then click Next.
- Specify the domain page allow you to choose the internal and external hostnames which you need for the following Exchange services:
- Exchange Web Services.
- Exchange ActiveSync.
- Autodiscover.
- Outlook Anywhere.
- IMAP.
- POP.
- Outlook on the Web.
- Offline Address Book generation (OAB).
When you select a service option, then the wizard determines which domain is suitable for the certificate and displays its information on the next page. Click Next.
- The wizard shows the domains it will include in the certificate. Choose to edit the domains. Finally, click Next.
- Specify the following organizational details in the form –
- Organization Name.
- Department Name.
- City/Locality.
- State/Province.
- Country/Region Name.
After filling the form, click Next.
- The ‘Save the certificate request to the following file’ page requires a UNC path to save the requested file. Input the whole path and the filename for the certificate request. Click Finish.
A new request has been created at the UNC path you input. You can also check at Servers >> Certificates that the request is present in the certificate list and its status is ‘Pending request.’
You will need the request file while filling out the new certificate form on the certified vendor’s website. When you get the certificate from the vendor, then you can complete the Pending request for the certificate.
Export SSL Certificate to New Exchange
When you move from an existing Exchange Server to another Exchange Server, you need to export the SSL certificate to the new Exchange Server as well.
- Go to the Source Exchange Server and open the IIS (Internet Information Service), Manager.
- Expand the websites, select the default website, right-click, and select Properties.
- Go to Security tab, click Server certificate and export to the PFX format.
- Now go to the destination Exchange Server and follow the same procedure. But Here, you need to Import the PFX file. The SSL certificate will be enabled for the new server.
Though migrating SSL certificates and configuring other Exchange settings are easy, the actual Exchange migration is not that easy for administrators. When you migrate the Exchange mailbox data to another Exchange, you may face a lot of difficulties. That’s why you should try a professional tool to handle Exchange migration.
How to remove old or expired SSL certificates safely?
Once an SSL certificate expires, you must remove it to avoid confusion in selecting among multiple certificates, misleading event logs error, etc. Follow the process to remove it:
Step 1: Run the following command in the Exchange Management Shell (EMS) to retrieve the list of all the certificates:
After getting the list classify into new and old certificates.
Step 2: Prepare a list of combined list of source transport servers that are related to each other:
Step 3: Stop Microsoft Exchange Transport service using the following command
Step 4: Use the following command to set send connector clear its TlsCertificateName properties:
Step 5: Run the following command to remove certificate from the source transport server found above:
Step 6: Run the given command to generate a property value for TlsCertificateName:
Step 7: Run the following command to assign the certificate value created in previous step:
Step 8: In the end, restart the Exchange Transport service using the following command:
Secure Exchange Data Migration with Kernel Migrator for Exchange
Kernel Migrator for Exchange is an advanced migration software that conducts fast and secure migration of unlimited Exchange mailbox data. It migrates all versions of Exchange Server and all types of deployments (on-premises, online, hybrid migration). There are numerous features in the software like pre-migration analyzer, Exchange data filters, scheduler, and more to perform the Exchange migration based on the requirements of the organization. You can also conduct a batch migration of Exchange mailbox using CSV file and monitor the ongoing status of each migration process.
Conclusion
With the methods explained above, you can easily generate an SSL Certificate request in Exchange Server. Moreover, if any certificate becomes outdated or expired, remove the certificate using the explained step-by-step commands in EMS. It is also important to remember that you’ll need to export and import the SSL certificate again after migration using manual methods. But you can skip this step by using a professional Exchange migrator for Exchange Server 2016 migration.
Frequently Asked Questions
Ans. A CSR, or Certificate Signing Request, is an encoded file submitted to a CA (Certificate Authority) to install an SSL certificate and protect the data of your organization’s mailboxes.
Ans. Yes. Whenever you renew your SSL/TLS security certificate, it is recommended to create a new CSR request.
