Shulou(Shulou.com)06/02 Report--

Encryption and certificates are very important to every enterprise. By default, the Exchange server uses TLS to encrypt direct communication between services within the server. So several certificates are generated after the Exchange server is installed, each for a different purpose. The following certificates are generated after the first installation of Exchange:

1), Microsoft Exchange this certificate is the self-signed certificate of the Exchange server, the authentication communication between the main user Exchange servers, each server will generate an independent self-signed certificate.

2), Microsoft Exchange Server Auth Certificate this certificate is also an Exchange self-signed certificate, but the Exchange server in an organization uses the same certificate, which is mainly used for server-to-server authentication [for example: federated authentication], and integrated applications that use OAut authentication. [for example: integration of Exchange with Skype For business and SharePoint].

3) WMSVC the self-signed certificate of WIndows server, which is mainly used for remote management in IIS. The IIS of each Exchange server generates an independent self-signed certificate. [for example: using Exchange Powershell to remotely connect to the server]

The Microsoft Exchange certificate update is simple, as long as you use the command New-ExchangeCertificate-server ServerName on each Exchange server to generate a self-signed certificate.

The following is mainly about how to manually create a Microsoft Exchange Server Auth Certificate certificate after it is lost or expired. [the following actions apply to Exchange 2013 and Universe 2016]

1. Open Exchange Powershell.

2. Create a certificate on any Exchange server using the following command.

New-ExchangeCertificate-KeySize 2048-PrivateKeyExportable $true-SubjectName "CN= Microsoft Exchange Server Auth Certificate"-DomainName "* .DOMAINNAME.COM"-FriendlyName "Microsoft Exchange Server Auth Certificate"-Services SMTP

After the command execution is complete, select N to copy the certificate Thumbprint fingerprint, and the following command will use the

3. Use the command to apply the new certificate for OAuth authentication configuration.

$date = Get-DateSet-AuthConfig-NewCertificateThumbprint certificate_thumbprint-NewCertificateEffectiveDate $date

Select YES.

4. Use the command to issue a new certificate.

Set-AuthConfig-PublishCertificate

If there is an old certificate on the server, you can clear the old certificate using the following command.

Set-AuthConfig-ClearPreviousCertificate

5. After the certificate is configured, you need to restart IIS by executing the IISRESET command on all CAS and Mailbox role servers.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.