This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hello! Need some help - I have a new Exchange 2019 CU12, trying to create a request for a certificate (Wildcard) from ECP->Servers->Certificates but I have no such option, look at this please:
Why is this option missing?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 62%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBM%3C/text%3E%3C/svg%3E)
Hi
It has been a long time since last reply, if the above suggestion helps, please click “Accept as answer” to mark helpful reply as an answer. Your action would be helpful to other users who encounter the same issue and read this thread.
Hi
To prevent misuse of UNC paths by attackers, it is designed to remove the parameters that take UNC paths as inputs from the Exchange Server PowerShell cmdlets and the Exchange Admin Center. These changes will affect all cumulative update (CU) releases of Microsoft Exchange Server 2019 (CU12 and later).
After you upgraded to Exchange Server 2019 CU12 , the following certificate functionality in EAC is removed:
You could get more information about upgrading to Exchange 2019 CU12 from this Microsoft Blog:changes-in-exchange-server-powershell-cmdlets-and-exchange-admin-center-for-unc-path-inputs-kb5014278-36af1640-4389-4ff1-b805-d1d63715a0dd
Instead of using EAC, you need to use EMS with command to complete creating a request for a certification authority. About the related command ,you can reference this Microsoft Document: create-ca-certificate-requests
If this Answer is helpful, please click "Accept Answer" to upvote it. If you have extra questions about this answer, please click "Comment" and I will come to your aid.
So can I use wildcard certificate with my Exchange 2019 CU12?
Hi
You still can use wildcard certificate while upgrading to Exchange 2019 CU12, but you need to configure it using Exchange Management Shell with command. About the detailed usage of the command, you still can follow the Microsoft Document:create-ca-certificate-requests
I'm sorry but still didn't understand :-( We have a *.crt- and *.key-files but manual says we also need *.pfx-file - right?
Hi! @Evgeny Shupik
The Software Publisher Certificate (SPC), and its private and public keys, must be stored in a Personal Information Exchange (.pfx) file to release signing. If the CA issued an .spc and its keys in non-.pfx files, you must convert and store the files in a .pfx file before they can be used for release-signing.
For more information about the necessity of configuring *.pfx-file , please reference this Microsoft Document :personal-information-exchange---pfx--files
Thank you - it's OK with Import :-) But let me to ask about another problem - I can't apply this certificate to POP3 and IMAP - receiving these errors:
Why is? Is this because of type of certificate? We have a *.company.com Wilcard cert but Exchange trying to accept FQDN: mail.corp.company.com. How to resolve it? Thank you for support.
Hi! @Evgeny Shupik
The Exchange tries to accept FQDN due to that the client uses FQDN to connect to IMAP4 and POP3’s service. It is also mentioned by Microsoft Document: assign-certificates-to-services that you need to run Set-POPSettings and Set-IMAPSettings command to connect to POP and IMAP’s service.
For the issue you encountered ,I would suggest you set a value of X509CertificateName by Set-POPSettings and Set-IMAPSettings command.
You can refer the following two commands to configure them :
After that, restart all POP and IMAP service on Exchange server. Then you can check whether this issue has been solved.
Excuse me but we need to work with real server name (as it available in real Internet - "mail.company.com") - seems to me it will be a wrong configuration? IMAP and POP should response also "mail.company.com", right?
P.S. I found another problem - after installing Exchange account on my iPhone, all the settings were correct but I don't see any message. Just empty folder "Inbox" and that is all (there is no even "Sent" folder). How do you think - why is it?
Hi! @Evgeny Shupik
Yes, you can change the mail.corp.company.com to the real server name. The mail.corp.company.com is an example name for you to reference. When you configure them , you can change the mail.corp.company.com to mai.company.com.
Due to this case is more concerned about the issue of certificate , I would suggest you to post the mobile issue to a new case. It can help others who encounters the same certificate issue to find the solution.
It also can help you accelerate the speed of solving time.