How to change Certificate on Microsoft Exchange Server

Learn how to manually replace an SSL/TLS certificate on Exchange Server, assign IIS, SMTP, POP and IMAP, handle connectors and restarts, and verify every protocol.

Exchange Server does not have one generic TLS binding. IIS protects HTTP client services, transport selects certificates for SMTP and STARTTLS, and the POP and IMAP services have their own protocol settings. A safe replacement therefore verifies each service independently before the old certificate is removed.

This procedure applies to supported on-premises Exchange Server 2016, 2019, and Subscription Edition. Run it on every Exchange server that terminates the relevant protocol.

Before you begin

Use the Exchange Management Shell with the required Client Access permissions.
Obtain a PFX with its private key and full issuing chain. Ensure the SANs cover the HTTP namespaces and any SMTP, POP, and IMAP FQDNs that will select it.
Record the old thumbprint, service assignments, receive/send connector TlsCertificateName values, POP/IMAP X509 names, and load-balancer pool membership.
Confirm POP/IMAP are actually enabled before planning to restart them; they are disabled by default in a standard Exchange installation.
If this is an Exchange hybrid deployment, record the certificate selected by the Hybrid Configuration Wizard and plan to update the hybrid connector configuration.

Understand how Exchange uses certificates

Service	What the assignment affects
IIS	Outlook on the web, EAC, EWS, ActiveSync, Autodiscover, OAB, MAPI/HTTP, Outlook Anywhere, and remote PowerShell on the Default Web Site.
SMTP	STARTTLS, mutual TLS, and transport connections. Receive and send connectors can select a certificate by issuer and subject through `TlsCertificateName`.
POP	POP3 TLS. Its advertised/service FQDN must match the certificate; Microsoft advises against assigning a wildcard certificate to POP.
IMAP	IMAP4 TLS, with the same explicit-FQDN consideration; Microsoft advises against assigning a wildcard certificate to IMAP.

The default Exchange self-signed SMTP certificate also protects internal transport. Enabling a public certificate for SMTP can prompt to replace that default assignment. Do not answer automatically: public/hybrid SMTP and internal Exchange transport are different concerns.

Step-by-step certificate replacement

Inventory the current configuration:

Get-ExchangeCertificate |
  Format-List FriendlyName,Subject,Issuer,CertificateDomains,Thumbprint,Services,NotAfter
Get-ReceiveConnector | Format-List Identity,Fqdn,TlsCertificateName
Get-SendConnector | Format-List Identity,Fqdn,TlsCertificateName
Get-PopSettings | Format-List X509CertificateName
Get-ImapSettings | Format-List X509CertificateName

Import the PFX. Reading it as bytes is required by current Exchange PowerShell:

$password = Read-Host "PFX password" -AsSecureString
$imported = Import-ExchangeCertificate `
  -FileData ([System.IO.File]::ReadAllBytes("C:\secure\exchange.pfx")) `
  -Password $password `
  -PrivateKeyExportable $false
$thumbprint = $imported.Thumbprint

Exchange Admin Center can also import a certificate under Servers > Certificates, but the shell makes the resulting thumbprint explicit.

Assign only the services used on this server:
```
Enable-ExchangeCertificate -Thumbprint $thumbprint -Services IIS,SMTP,POP,IMAP
```
Service assignments can be added but not removed from a certificate. Moving a service means assigning the replacement, then retaining or later deleting the old certificate.
Treat the SMTP prompt deliberately. In most environments the default Exchange self-signed certificate remains appropriate for internal SMTP. The public certificate can still be SMTP-enabled for external STARTTLS. Confirm the outcome:
```
Get-ExchangeCertificate -Thumbprint $thumbprint |
  Format-List Thumbprint,Services,Subject,CertificateDomains
```
Update any connector pinned by issuer and subject. Exchange does not use the thumbprint in TlsCertificateName:
```
$cert = Get-ExchangeCertificate -Thumbprint $thumbprint
$tlsName = "<I>$($cert.Issuer)<S>$($cert.Subject)"
Set-ReceiveConnector -Identity "<server>\<receive-connector>" -TlsCertificateName $tlsName
Set-SendConnector -Identity "<send-connector>" -TlsCertificateName $tlsName
```
If the renewed certificate has the same issuer and subject, Exchange may select the newest valid matching certificate. Still inspect every connector. For hybrid mail flow, Microsoft recommends rerunning the Hybrid Configuration Wizard when the selected certificate changes; its current renewal procedure also restarts MSExchangeTransport after connector changes.
If POP or IMAP is used, ensure the configured FQDN is represented by a SAN:
```
Set-PopSettings -X509CertificateName pop.example.com
Set-ImapSettings -X509CertificateName imap.example.com
Restart-Service MSExchangePOP3,MSExchangePOP3BE
Restart-Service MSExchangeIMAP4,MSExchangeIMAP4BE
```
Restart only the protocol pairs that are enabled and changed. The frontend service proxies to the backend service, so both in the pair matter.
For SMTP connector changes, restart transport during the maintenance window:
```
Restart-Service MSExchangeTransport
Restart-Service MSExchangeFrontEndTransport
```
Coordinate this per server so other transport nodes continue carrying mail.
For IIS, do not blindly run iisreset. The certificate assignment updates the IIS service binding. Microsoft says a restart might be needed when Exchange continues using the previous certificate for the Outlook on the web authentication cookie, and recommends restarting IIS in environments with Layer 4 load balancing. If that scenario applies, drain the node first and run iisreset; otherwise validate new TLS handshakes before causing a broad IIS interruption.

Product-specific considerations

Exchange certificates are local to a server. A database availability group does not replicate the PFX or service assignment. Update and test one Client Access/transport node at a time.

ECC certificate support for Exchange 2016/2019 was expanded by the April and November 2024 updates and remains disabled by default behind Exchange's documented setting. Federation Trust and Exchange OAuth certificates must still be RSA, and ECC is not supported with AD FS claims-based authentication. Do not introduce ECC merely as part of a routine renewal without validating the fully patched version and every service.

An Edge Transport server with an Edge Subscription has additional replacement requirements: Microsoft documents removing the old CA-issued certificate and recreating the Edge Subscription. Treat it as a separate change plan.

Verify the new certificate

Verify assignment, then the network endpoint:

Get-ExchangeCertificate -Thumbprint $thumbprint |
  Format-List Subject,Issuer,CertificateDomains,Thumbprint,Services,NotAfter
Test-ServiceHealth

openssl s_client -connect mail.example.com:443 -servername mail.example.com
openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.com
openssl s_client -starttls imap -connect imap.example.com:143 -servername imap.example.com
openssl s_client -starttls pop3 -connect pop.example.com:110 -servername pop.example.com

Also test implicit TLS ports 993 and 995 when clients use them, authenticated submission on 587, Autodiscover, Outlook on the web, and hybrid mail flow. Run the Microsoft Exchange Health Checker according to its current instructions for a broader post-change assessment.

Rollback

Re-enable the old thumbprint for the affected services, restore connector TlsCertificateName values, restart only the affected protocol services, and put the node back into rotation after network tests. Because assignments cannot be removed, rollback is safer while the old certificate remains installed.

Common problems

The PFX has no private key or was imported on a different Exchange server.
IIS works but SMTP still selects a certificate through a connector's old issuer and subject.
The public SMTP certificate accidentally replaced the internal default certificate.
POP/IMAP uses an FQDN absent from the SAN or is still serving through an unrestarted frontend/backend service pair.
An administrator removes the old certificate before checking hybrid, Edge, receive, and send connector dependencies.
Only one node behind the load balancer was updated.

Automating certificate replacement with aethercert

The aethercert Exchange target runs Exchange's certificate import and assigns the selected IIS, SMTP, POP, and IMAP services on the local server. Connector-specific TlsCertificateName, hybrid configuration, and environment-specific maintenance decisions must still be reviewed where they apply.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.