DE

Home / Acmefyer / Exchange certificate

AcmefyerAgent-based Certificate Manager

Renew and install the Exchange certificate automatically.

Outlook, OWA, ActiveSync and Autodiscover depend on the Exchange server’s certificate, and every replacement is manual work in the Exchange Management Shell. Acmefyer obtains the certificate via ACME, for example for free from Let’s Encrypt, and an agent on the Exchange server installs it itself. For Exchange Server SE and 2019.

Explore Acmefyer Documentation
01By handWhat every replacement involves

How to renew the Exchange certificate by hand.

A new certificate as a PFX file gets into Exchange in four steps, in the Exchange Management Shell on every Exchange server:

# 1. Import the certificate
Import-ExchangeCertificate -FileData ([System.IO.File]::ReadAllBytes('C:\certs\mail.pfx')) -Password (Read-Host -AsSecureString)
# 2. Enable it for IIS, IMAP and POP
Enable-ExchangeCertificate -Thumbprint <thumbprint> -Services IIS,IMAP,POP
# 3. Point IMAP and POP to the name in the certificate
Set-ImapSettings -X509CertificateName mail.example.com
Set-PopSettings -X509CertificateName mail.example.com
# 4. Restart IMAP and POP
Restart-Service MSExchangeIMAP4,MSExchangeIMAP4BE,MSExchangePOP3,MSExchangePOP3BE
SMTP
Usually not included: the transport selects its certificate by the server name (such as ex01.corp.local), which a public certificate cannot cover.
Old certificate
Better kept in the store as long as the Exchange back end site (port 444) uses it.
Key
Exchange Server SE accepts ECC certificates only with a dedicated override. An RSA key is the safe choice.
DAG
Every server in the DAG needs the certificate, preferably not all at once.
How often
Since March 2026 public certificates are valid for at most 200 days, from 2029 for only 47 days. The replacement is then due roughly every month, on every Exchange server.
02With AcmefyerWhat the agent takes care of

The agent on the Exchange server handles every step itself.

The Acmefyer server obtains the certificate from the certificate authority, for example for mail.example.com and autodiscover.example.com, and renews it 30 days before expiry. The Acmefyer agent runs as a service on the Exchange server, picks up the new certificate there and installs it locally.

The Exchange server needs no open port and no internet access for this, and the Acmefyer server stores no administrator passwords. The connection only goes from the agent to the server.

Import
Import the new certificate into Exchange. One that is already imported is just enabled again.
Enable
For the selected services, by default IIS, IMAP and POP. SMTP only if you select it explicitly.
IMAP, POP
Set the certificate name (X509CertificateName) to a name the new certificate covers and restart both services.
Verify
Afterwards the agent checks whether port 443 serves the new certificate. If not, it enables the previous one for IIS again.
DAG
One deployment per Exchange server with its agent. Acmefyer never rolls out to all of them at once, but with at least one hour between two servers.
Detection
The agent detects Exchange on its server and suggests the matching deployment.
03SetupSet up once, then it runs on its own
  1. 01

    Add a domain

    mail.example.com and autodiscover.example.com, with an RSA key and validation via HTTP-01 or DNS-01.

  2. 02

    Install the agent

    Run the setup package on the Exchange server. The agent installs itself as a service.

  3. 03

    Create the deployment

    The agent has detected Exchange. One click creates the deployment.

  4. 04

    Done

    From now on Acmefyer renews the certificate in time and reports every result.

04FAQFrequently asked questions about the Exchange certificate

Which Exchange versions does Acmefyer support?

Exchange Server SE and Exchange Server 2019. The agent runs on every Exchange server for this.

Can I use a Let’s Encrypt certificate for Exchange?

Yes. Outlook, OWA, ActiveSync and Autodiscover trust Let’s Encrypt like any other public certificate authority. Requirement: all names in the certificate are public names such as mail.example.com. No public certificate authority issues internal names such as ex01.corp.local.

Does SMTP need the new certificate?

Usually not. The Exchange transport selects its certificate by the server name, which a public certificate cannot cover. Acmefyer therefore enables IIS, IMAP and POP, and SMTP only if you select it explicitly, for example when a connector uses the public name.

What happens if the replacement fails?

After the replacement the agent checks whether port 443 serves the new certificate. If not, it enables the previous certificate for IIS again and Acmefyer reports the error. Acmefyer retries a failed target after 5 minutes, then at growing intervals.

Does this work in a DAG?

Yes. You create one deployment per Exchange server with its agent. Acmefyer then distributes the certificate server by server, at least one hour apart, so that never all servers are switched at once.

Do I need a wildcard certificate for Exchange?

No. A certificate with the names mail.example.com and autodiscover.example.com is enough. A wildcard certificate works too; for IMAP and POP the agent then sets a name without the wildcard.