Microsoft Exchange Server: SSL certificate via ACME

Q: Which services get the new certificate enabled?

By default IIS,SMTP,IMAP,POP . That covers OWA, EWS, ActiveSync, autodiscover (all via IIS), plus SMTP, IMAP and POP if enabled. Adjust the list in --scriptparameters if you do not use a given service.

Exchange Server 2013, 2016 and 2019 can be automated with simple-acme. The certificate is installed in the Windows Certificate Store, bound to IIS for OWA and EWS, and enabled for SMTP, IMAP and POP via ImportExchange.v2.ps1. Existing internal Exchange certificates are left alone.

Setup

Step 1: Install simple-acme

Grab FairSSL\'s simple-acme build (pre-configured with the right ACME settings and ships ImportExchange.v2.ps1 in the Scripts folder). Extract to C:\simple-acme on the Exchange server.

Step 2: Prepare the environment

Every relevant domain is configured for FairSSL AutoDNS.
The example assumes one Exchange server with OWA on IIS. Adjust the --host list as needed.
Open Exchange Management Shell as administrator and cd to C:\simple-acme.

Step 3: Issue and enable

Run the command in Exchange Management Shell as administrator. simple-acme issues the certificate, installs it with Network Service and Administrators as ACL owners (so Exchange can read the private key), binds it in IIS, and calls ImportExchange.v2.ps1 to enable it for the listed services.

wacs.exe --verbose --baseuri "https://fairssl.dk/acme" `
  --eab-key-identifier YOUR_EAB_KID --eab-key YOUR_EAB_HMAC --accepttos `
  --source manual --csr rsa `
  --certificatestore My --acl-fullcontrol "network service,administrators" `
  --validation none `
  --installation iis,script --script "./Scripts/ImportExchange.v2.ps1" `
  --scriptparameters "'{CertThumbprint}' 'IIS,SMTP,IMAP,POP' 1 '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'" `
  --host "mail.example.com,autodiscover.example.com" `
  --friendlyname "fairssl-acme-mail.example.com"

Step 4: Verify services

Run the following in Exchange Management Shell to confirm Exchange has enabled the certificate for the right services (expect flags like IPWS on the new certificate):

Get-ExchangeCertificate
Get-WebBinding

Step 5: Confirm IIS bindings

Default Website should use the new certificate.
Exchange Back End should still use the internal certificate (typically named "Microsoft Exchange").
Test publicly with FairSSL\'s SSL scanner.

Step 6: Tune the simple-acme renewal window

If you used the FairSSL simple-acme build this is already set. Otherwise edit settings.json: ScheduledTask → RenewalDays = 365 and ScheduledTask → RenewalMinimumValidDays = 7. That lets ARI drive renewal, but forces a renewal no later than 7 days before expiry.

Things to know

The internal "Microsoft Exchange" certificate still needs renewal

Exchange Server uses its own internal certificate for the Exchange Back End IIS site and a number of internal services. The ACME flow does not touch it. Watch its expiry and renew it using Exchange tooling.

Wildcard certificates do not fully cover SMTP, IMAP and POP

Exchange only uses the wildcard for OWA, EWS and ActiveSync. SMTP, IMAP and POP require the specific FQDN in SAN. If missing, Exchange falls back to the internal certificate for those services. Order a SAN certificate listing every FQDN to avoid this.

Frequently asked questions

Find answers to the most common questions about SSL certificates and FairSSL.

Which Exchange versions are supported?

Exchange Server 2013, 2016 and 2019. ImportExchange.v2.ps1 uses the Exchange Management Shell cmdlet Enable-ExchangeCertificate to enable the new certificate for the relevant services (IIS, SMTP, IMAP, POP). simple-acme itself handles installation in the Windows Certificate Store and the IIS binding.

Should I let Exchange keep its internal "Microsoft Exchange" certificate?

Yes. Exchange Server needs a valid internal certificate for the Exchange Back End IIS site and several internal services. It is usually called Microsoft Exchange and gets created during installation. Our ACME flow only replaces the front-end certificates on OWA, EWS, ActiveSync, SMTP, IMAP and POP - never the internal one. Renew the internal certificate separately using Exchange tooling before it expires.

Do wildcard certificates work with Exchange?

Partly. Exchange accepts a wildcard SSL/TLS certificate for OWA, EWS and ActiveSync, but SMTP, IMAP and POP do not use the wildcard unless the specific FQDN is in the certificate's SAN. If no other certificate contains the FQDN, Exchange falls back to the internal certificate for those services. We recommend a SAN certificate with every relevant FQDN (mail.example.com, autodiscover.example.com, smtp.example.com).

Should I use Exchange Management Shell or regular PowerShell?

Exchange Management Shell. The script calls Exchange-specific cmdlets that are not available in a stock PowerShell. Open EMS as administrator and cd to C:\simple-acme before running the command.

Which services get the new certificate enabled?

By default IIS,SMTP,IMAP,POP. That covers OWA, EWS, ActiveSync, autodiscover (all via IIS), plus SMTP, IMAP and POP if enabled. Adjust the list in --scriptparameters if you do not use a given service.

What happens at renewal?

simple-acme schedules a daily task. When ARI or the built-in 7-day fallback triggers a renewal, the new certificate is installed in the Windows Certificate Store, the IIS binding is updated, and ImportExchange.v2.ps1 runs again to enable it for the same Exchange services. The old certificate stays in the store until it expires.

Ready to automate Exchange certificates?

Create a free account and issue your first certificate in under 10 minutes.

Create free account Compare certificates