Creating a Certificate for Exchange Server 2019 Issue

Mahmoud Teleb 0

I tried to create a certificate for Exchange server 2019 cu12, I've designated my Active Directory as a Certificate Authority(CA), then I've created a CSR on Exchange by running the following commands:

$binrequest = New-ExchangeCertificate -GenerateRequest -BinaryEncoded -SubjectName "c=US,o=Woodgrove Bank,cn=mail.woodgrovebank.com" -DomainName autodiscover.woodgrovebank.com,mail.fabrikam.com,autodiscover.fabrikam.com

[System.IO.File]::WriteAllBytes('\FileServer01\Data\woodgrovebank.pfx', $binrequest.FileData)

When I try to open the certificate request file, an message appeared says"This file is invalid for use as the following:Personal Information Exchange" Screenshot_45

So, what must I do for taking the request file and put it into the Certificate Authority to create the certificate and import it to the Exchange Server2019 cu12

1 answer

Jake Zhang-MSFT 5,055 Reputation points Microsoft Vendor

2024-08-26T07:20:32.9333333+00:00
Hi @Mahmoud Teleb,

Welcome to the Microsoft Q&A platform!

It looks like you're creating a certificate request (CSR) for your Exchange Server 2019 CU12 and encountering an issue with the format of the request file. The error "This file is invalid for use as the following: Personal Information Exchange" suggests that the file you generated is not in the correct format for the task you're attempting.

Here's a step-by-step guide to correctly create and use the CSR file:

Create the CSR (Certificate Signing Request):

   Use the following PowerShell command to generate a Base64-encoded CSR file, which is more commonly used for submission to a CA.

   $csr = New-ExchangeCertificate -GenerateRequest -SubjectName "c=US,o=Woodgrove Bank,cn=mail.woodgrovebank.com" -DomainName autodiscover.woodgrovebank.com,mail.fabrikam.com,autodiscover.fabrikam.com    Set-Content -Path '\\FileServer01\Data\woodgrovebank.req' -Value $csr

   This will create a CSR in the proper format for you to submit to your CA.

Submit the CSR to the CA:

   - On your CA server, open the Certification Authority console.

   - Right-click on the CA name -> All Tasks -> Submit a new request.

   - Browse to the file woodgrovebank.req that you created and submit it.

Issue the Certificate:

   - Once the request is submitted, go to Pending Requests in the Certification Authority console.

   - Find your request, right-click on it, and choose 'Issue.'

   - Go to the Issued Certificates section, find your certificate, right-click on it, and choose 'Export' to export the certificate (in DER encoded .cer file format).

Import the Certificate to Exchange Server:

   Use the following PowerShell command to import the certificate to the Exchange server:

   Import-ExchangeCertificate -FileData ([Byte[]]$(Get-Content -Path "\\FileServer01\Data\woodgrovebank.cer" -Encoding Byte -ReadCount 0)) -FriendlyName "WoodgroveBankCertificate"

Enable the Certificate for Exchange Services:

   Use the following PowerShell command to enable the certificate for the required Exchange services (e.g., IIS, SMTP):

   Enable-ExchangeCertificate -Thumbprint <ThumbprintGenerated> -Services IIS,SMTP

   Replace <ThumbprintGenerated> with the actual thumbprint from the imported certificate.

By following these steps, you should be able to create a CSR, submit it to your CA, obtain the certificate, and import it into your Exchange Server 2019 CU12.

Please feel free to contact me if you have any queries.

Best,

Jake Zhang
Please sign in to rate this answer.
Mahmoud Teleb 0 Reputation points

2024-08-26T14:10:53.53+00:00

It didn't work Jake. The same message error appeared at "Submit the CSR to the CA" step, here you find an attachment for that.

Jake Zhang-MSFT 5,055 Reputation points Microsoft Vendor

2024-08-28T08:23:26.68+00:00

Hi @Mahmoud Teleb,

Thanks for your response!

This error typically occurs when the subject name in the certificate request is either invalid or exceeds the allowed length.

Here's a few steps you can take to resolve this issue:

Check the Subject Name: Ensure that the subject name in your certificate request is correctly formatted and does not contain any invalid characters. The subject name usually includes fields like CN (Common Name), OU (Organizational Unit), O (Organization), L (Locality), ST (State), and C (Country).

Length of Subject Name: Verify that the total length of the subject name does not exceed 64 characters for each field and 256 characters in total.

Certificate Request Tool: If you are using a tool like certreq.exe, double-check the certificate request file for any errors in formatting.

Active Directory: If your request is validated against Active Directory, ensure that the information there is also correct and does not have any issues.

Here is an example of a properly formatted subject name:

CN=example.com, OU=IT, O=Example Corporation, L=City, ST=State, C=US

Please feel free to contact me if you have any queries.

Best,

Jake Zhang

Jake Zhang-MSFT 5,055 Reputation points Microsoft Vendor

2024-08-30T09:30:48.15+00:00

Hi @Mahmoud Teleb ,

Please kindly consider this comment as a warm follow up, I want to know if your problem has been solved. If you still have any other questions, please feel free to comment here and I'm glad to provide further support.If the above info is helpful to this question, you can click "Accept Answer". Have a nice day!

Best,

Jake Zhang

Mahmoud Teleb 0 Reputation points

2024-09-01T10:02:55.6766667+00:00

Hi Jake,
Thanks for your interest in my issue, just let me try the last tech note you sent and then I will inform you with the final result.

Jake Zhang-MSFT 5,055 Reputation points Microsoft Vendor

2024-09-02T01:36:35.06+00:00

Hi @Mahmoud Teleb ,

Thanks for your response. I will check if my answer is helpful to you. If it is helpful, I hope you can click the "Accept Answer" button, which will help users with similar problems in the forum to find solutions quickly. Thank you for your understanding and help in improving the forum environment.

Best,

Jake Zhang

Mahmoud Teleb 0 Reputation points

2024-09-03T07:09:42.7033333+00:00

I tried again but it did not work, I've found that .req parameter is not available in Exchange Server 2019 CU12 and later, and there is another parameter called .pfx.

By the way I have another issue with Outlook and Autodicover service as following:

Mahmoud Teleb 0 Reputation points

2024-09-03T07:11:00.1933333+00:00

Outlook issue as shown, so any recommendations please.

Jake Zhang-MSFT 5,055 Reputation points Microsoft Vendor

2024-09-05T09:18:34.07+00:00

Hi @Mahmoud Teleb,

Thanks for your response!

According to your description, let’s tackle them one by one.

Issue 1: Certificate Request in Exchange Server 2019 CU12 and Later

Since the .req parameter is not available in Exchange Server 2019 CU12 and later, you should use the .pfx parameter instead. Here’s a step-by-step guide to help you:

1.Generate the Certificate Signing Request (CSR): Use the following PowerShell command to generate a Base64-encoded CSR file:

$csr = New-ExchangeCertificate -GenerateRequest -SubjectName "c=US,o=Example Corp,cn=mail.example.com" -DomainName autodiscover.example.com,mail.example.com Set-Content -Path '\\FileServer01\Data\example.req' -Value $csr

2.Submit the CSR to the Certificate Authority (CA):

-On your CA server, open the Certification Authority console.

-Right-click on the CA name -> All Tasks -> Submit a new request.

-Browse to the .req file you created and submit it.

3.Issue and Export the Certificate:

-Once the request is submitted, go to Pending Requests in the Certification Authority console.

-Find your request, right-click on it, and choose ‘Issue.’

-Go to the Issued Certificates section, find your certificate, right-click on it, and choose ‘Export’ to export the certificate in .pfx format.

4.Import the Certificate to Exchange Server: Use the following PowerShell command to import the certificate:

Import-ExchangeCertificate -FileData ([Byte[]]$(Get-Content -Path '\\FileServer01\Data\example.pfx' -Encoding Byte -ReadCount 0)) -FriendlyName "ExampleCertificate"

Issue 2: Outlook and Autodiscover Service Certificate Error

The error message you’re seeing typically occurs when the URL in the certificate does not match the URL being accessed. Here’s how to resolve it:

1.Check DNS Records: Ensure that your Autodiscover DNS records are correctly configured. The Autodiscover service should be accessible via a URL that matches the Subject or Subject Alternative Name (SAN) in your SSL certificate.

2.Create a New SRV Record: If necessary, create a new SRV record in your DNS zone:

-Service: _autodiscover

-Protocol: _tcp

-Port: 443

-Host: The URL for redirection (e.g., autodiscover.example.com)

3.Update the Certificate: Make sure the SSL certificate includes all necessary domain names in the SAN field. This might involve reissuing the certificate with the correct names.

4.Verify the Certificate: Check the certificate details in Outlook to ensure it matches the expected domain names.

If you follow these steps, you should be able to resolve both issues.

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang

Jake Zhang-MSFT 5,055 Reputation points Microsoft Vendor

2024-09-09T01:20:30.38+00:00

Hi @Mahmoud Teleb,

Since you haven't replied for a long time, I would like to ask if your problem has been solved. If it has been solved, I hope you can click the "Accept Answer" button on the answer to the useful reply. This will help other users with similar problems in the forum to find solutions to their problems under this answer. Thank you very much for your understanding and improvement of the forum environment! Have a nice day!

Best regards,

Jake Zhang
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Creating a Certificate for Exchange Server 2019 Issue

1 answer

Issue 1: Certificate Request in Exchange Server 2019 CU12 and Later

Issue 2: Outlook and Autodiscover Service Certificate Error

Your answer