Microsoft Exchange Server: SSL certificate via ACME

Q: Which services get the new certificate enabled?

By default IIS,SMTP,IMAP,POP . That covers OWA, EWS, ActiveSync, autodiscover (all via IIS), plus SMTP, IMAP and POP if enabled. Adjust the list in --scriptparameters if you do not use a given service.

Exchange Server 2013, 2016, 2019 and Subscription Edition can be automated with simple-acme. The certificate is installed in the Windows Certificate Store, bound to IIS for OWA and EWS, and enabled for SMTP, IMAP and POP via ImportExchange.v3.ps1. Existing internal Exchange certificates are left alone.

Supported versions

Platform	Versions	Runs on	ACME client
Exchange Server	Versions2013, 2016, 2019 and Subscription Edition	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportExchange.v3.ps1

Setup

Step 1: Install simple-acme

Grab FairSSL\'s simple-acme build (pre-configured with the right ACME settings and ships ImportExchange.v3.ps1 in the Scripts folder). Extract to C:\simple-acme on the Exchange server.

Step 2: Prepare the environment

Every relevant domain is configured for FairSSL AutoDNS.
The example assumes one Exchange server with OWA on IIS. Adjust the --host list as needed.
Open Exchange Management Shell as administrator and cd to C:\simple-acme.

Step 3: Issue and enable

Run the command in Exchange Management Shell as administrator. simple-acme issues the certificate, installs it with Network Service and Administrators as ACL owners (so Exchange can read the private key), binds it in IIS, and calls ImportExchange.v3.ps1 to enable it for the listed services.

wacs.exe --verbose --baseuri "https://fairssl.dk/acme" `
  --eab-key-identifier YOUR_EAB_KID --eab-key YOUR_EAB_HMAC --accepttos `
  --source manual --csr rsa `
  --certificatestore My --acl-fullcontrol "network service,administrators" `
  --validation none `
  --installation iis,script --script "./Scripts/ImportExchange.v3.ps1" `
  --scriptparameters "'{CertThumbprint}' 'IIS,SMTP,IMAP,POP' 1 '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'" `
  --host "mail.example.com,autodiscover.example.com" `
  --friendlyname "fairssl-acme-mail.example.com"

Step 4: Verify services

Run the following in Exchange Management Shell to confirm Exchange has enabled the certificate for the right services (expect flags like IPWS on the new certificate):

Get-ExchangeCertificate
Get-WebBinding

Step 5: Confirm IIS bindings

Default Website should use the new certificate.
Exchange Back End should still use the internal certificate (typically named "Microsoft Exchange").
Test publicly with FairSSL\'s SSL scanner.

Step 6: Tune the simple-acme renewal window

If you used the FairSSL simple-acme build this is already set. Otherwise edit settings.json: ScheduledTask → RenewalDays = 365 and ScheduledTask → RenewalMinimumValidDays = 7. That lets ARI drive renewal, but forces a renewal no later than 7 days before expiry.

Things to know

The internal "Microsoft Exchange" certificate still needs renewal

Exchange Server uses its own internal certificate for the Exchange Back End IIS site and a number of internal services. The ACME flow does not touch it. Watch its expiry and renew it using Exchange tooling.

Wildcard certificates do not fully cover SMTP, IMAP and POP

Exchange only uses the wildcard for OWA, EWS and ActiveSync. SMTP, IMAP and POP require the specific FQDN in SAN. If missing, Exchange falls back to the internal certificate for those services. Order a SAN certificate listing every FQDN to avoid this.

Certificates on many servers and appliances

A publicly trusted SSL certificate can be valid for at most 199 days now, 99 days by 15 March 2027 and 46 days by 15 March 2029. Each certificate then has to be replaced at least twice a year now and at least eight times a year from 2029, on every server, firewall and load balancer that uses it. sslbrain from FairSSL runs as an appliance in your own network and renews and installs the certificates from one place, including on devices without an agent.

How sslbrain renews and installs certificates on Exchange

Frequently asked questions

Find answers to the most common questions about SSL certificates and FairSSL.

Which Exchange versions are supported?

Exchange Server 2013, 2016, 2019 and Subscription Edition, on Windows Server 2012 or newer. ImportExchange.v3.ps1 uses the Exchange Management Shell cmdlet Enable-ExchangeCertificate to enable the new certificate for the relevant services (IIS, SMTP, IMAP, POP). simple-acme itself handles installation in the Windows Certificate Store and the IIS binding.

Should I let Exchange keep its internal "Microsoft Exchange" certificate?

Yes. Exchange Server needs a valid internal certificate for the Exchange Back End IIS site and several internal services. It is usually called Microsoft Exchange and gets created during installation. Our ACME flow only replaces the front-end certificates on OWA, EWS, ActiveSync, SMTP, IMAP and POP - never the internal one. Renew the internal certificate separately using Exchange tooling before it expires.

Do wildcard certificates work with Exchange?

Partly. Exchange accepts a wildcard SSL/TLS certificate for OWA, EWS and ActiveSync, but SMTP, IMAP and POP do not use the wildcard unless the specific FQDN is in the certificate's SAN. If no other certificate contains the FQDN, Exchange falls back to the internal certificate for those services. We recommend a SAN certificate with every relevant FQDN (mail.example.com, autodiscover.example.com, smtp.example.com).

Should I use Exchange Management Shell or regular PowerShell?

Exchange Management Shell. The script calls Exchange-specific cmdlets that are not available in a stock PowerShell. Open EMS as administrator and cd to C:\simple-acme before running the command.

Which services get the new certificate enabled?

By default IIS,SMTP,IMAP,POP. That covers OWA, EWS, ActiveSync, autodiscover (all via IIS), plus SMTP, IMAP and POP if enabled. Adjust the list in --scriptparameters if you do not use a given service.

What happens at renewal?

simple-acme schedules a daily task. When ARI or the built-in 7-day fallback triggers a renewal, the new certificate is installed in the Windows Certificate Store, the IIS binding is updated, and ImportExchange.v3.ps1 runs again to enable it for the same Exchange services. The old certificate stays in the store until it expires.

Ready to automate Exchange certificates?

Create a free account and order your first certificate. A DV certificate is issued in under 2 minutes.

Create free account Compare certificates