Windows 2022
Sponsored Link

Exchange Server 2019 : Update Certificate
2023/02/08
 
Certificates for Exchange Server services is generated and configured when it is installed, however you can replace them to your certificates if you need.
 
On this example, it uses certificate from Let's Encrypt like here.
[1] Run PowerShell with Admin Privilege and configure certificate. 
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

# store export password you set on certificate to a variable
PS C:\Windows\system32> $Password = ConvertTo-SecureString -AsPlainText -Force "P@ssw0rd" 

# import to [Cert:\LocalMachine\My]
# ⇒ on GUI look, stored under [Certificates - Local Computer] - [Personal]
PS C:\Windows\system32> Import-PfxCertificate -FilePath C:\Users\exchangeadmin\Documents\rx-7.pfx -CertStoreLocation Cert:\LocalMachine\My -Password $Password 

   PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\My

Thumbprint                                Subject
----------                                -------
6C7648B176D4C934C3D9A71FE7F3F06399CAFEF7  CN=rx-7.srv.world

PS C:\Windows\system32> Get-ChildItem Cert:\LocalMachine\My

   PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\My

Thumbprint                                Subject
----------                                -------
D2AEA43568E12FD5F51609A4B37F89666DA089EB  CN=Microsoft Exchange Server Auth Certificate
B8F883E98D6C53CC42A0A59FCB87EADF82EACE0A  CN=WMSvc-SHA2-RX-7
844D53BAE5AE894BBDEBFE0B4960A55D925A191D  CN=rx-7
6C7648B176D4C934C3D9A71FE7F3F06399CAFEF7  CN=rx-7.srv.world
# 3 entries from the top are automatically generated one by Exchange


PS C:\Windows\system32> LaunchEMS 

# assign new certificate to services
[PS] C:\Windows\system32> Enable-ExchangeCertificate -Thumbprint 6C7648B176D4C934C3D9A71FE7F3F06399CAFEF7 -Services POP,IMAP,IIS,SMTP 

Confirm
Overwrite the existing default SMTP certificate?

Current certificate: '844D53BAE5AE894BBDEBFE0B4960A55D925A191D' (expires 2/2/2028 10:41:24 PM)
Replace it with certificate: '6C7648B176D4C934C3D9A71FE7F3F06399CAFEF7' (expires 2/28/2023 7:14:51
 PM)
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [?] Help (default is "Y"): Y

[PS] C:\Windows\system32> Get-ExchangeCertificate 

Thumbprint                                Services   Subject
----------                                --------   -------
D2AEA43568E12FD5F51609A4B37F89666DA089EB  ....S..    CN=Microsoft Exchange Server Auth Certificate
844D53BAE5AE894BBDEBFE0B4960A55D925A191D  IP.WS..    CN=rx-7
B8F883E98D6C53CC42A0A59FCB87EADF82EACE0A  .......    CN=WMSvc-SHA2-RX-7
6C7648B176D4C934C3D9A71FE7F3F06399CAFEF7  IP.WS..    CN=rx-7.srv.world
Matched Content