How to add a SAN Certificate to Exchange 2019 Server via Powershell

72 views 0 Comments

Due to the latest Exchange 2019 update, you now have to use Powershell to install the certificate. To add a Unified Communications Certificate (UCC), also known as a Subject Alternative Name (SAN) certificate, to an Exchange 2019 server via PowerShell, you can use the Import-ExchangeCertificate cmdlet. Here’s a step-by-step guide:

  1. Prepare the Certificate Files:
    Ensure that you have the certificate files ready. Typically, you’ll have the certificate file itself (with a .cer or .pfx extension) and, if applicable, the intermediate certificate files.
  2. Copy Certificate Files to Exchange Server:
    Copy the certificate files to a location accessible from your Exchange server. For example, you might copy them to a folder on the server’s hard drive.
  3. Open Exchange Management Shell (EMS):
    Open the Exchange Management Shell with administrative privileges.
  4. Import the Certificate:
    Use the Import-ExchangeCertificate cmdlet to import the certificate. The basic syntax is as follows:
   Import-ExchangeCertificate -FileData ([byte[]]$(Get-Content -Path "Path\to\CertificateFile.cer" -Encoding Byte -ReadCount 0))

Replace "Path\to\CertificateFile.cer" with the actual path to your certificate file.

  1. Assign Services to the Certificate:
    After importing the certificate, you need to assign services (such as IIS, SMTP, POP, IMAP, etc.) to it. Use the Enable-ExchangeCertificate cmdlet for this purpose. For example, to assign the certificate to the IIS service, you would run:
   Enable-ExchangeCertificate -Thumbprint <Thumbprint> -Services "IIS"

Replace <Thumbprint> with the thumbprint of the imported certificate. You can obtain the thumbprint by running the Get-ExchangeCertificate cmdlet.

  1. Verify Certificate Assignment:
    After assigning services to the certificate, you can verify the assignment using the Get-ExchangeCertificate cmdlet:
   Get-ExchangeCertificate | Format-List

Ensure that the certificate is listed and that the intended services are enabled.

  1. Restart Exchange Services (if necessary):
    Depending on the services you’ve assigned the certificate to, you may need to restart certain Exchange services for the changes to take effect.

That’s it! You’ve now successfully added a UCC SSL certificate to your Exchange 2019 server via PowerShell. Make sure to test your Exchange services to ensure they are using the new certificate properly.

Leave a Reply

Your email address will not be published. Required fields are marked *