Hi. I have installed Exchange 2019 for testing purposes. I have purchased a domain name and a certificate. After I installed it, the status shows: invalid. Thank you.

Hi @Alain Bensimon Like Andy mentioned above, if we get the invalid status for the certificate imported to Exchange server, we need to make sure the entire chain accessible. Please use the command below in EMS to get the detailed information of the invalid certificate, you could share the results here, remember to clear your presonal information Get-ExchangeCertificate -Thumbprint "XXXXXXX" | Format-List Especially the RootCAType, I see some issue was caused by Unknown RootCA. Just like this thread discussed: Added new SSL cert - showing as "invalid" Fix this issue and see how it looks You need the Root CA certificate for this. Check it on the vendor website and get it. You have to import it to the certificate console by the following method Launch a new Microsoft Management Console (Start -> Run, mmc.exe) and add the Certificates snap-in to it, connecting to the Computer Account for the Local Computer. Navigate to Trusted Root Certification Authorities. Right-click on Certificates and choose All Tasks and then Import. And if you have performed the operation correctly above, the status changed to "revocation check failed". Check if the CRL paths in the cerificate can be reached. The paths can be found by opening the certificate, click on Details, scroll to 'CRL Distribution Paths' Here you find a path CRL Distribution Point Distribution Point Name: Full Name: URL=http://xxx.com/xxx.crl Then copy the URL en paste it in Internet Explorer. This path must be resolvable. Refer to this link to get more information: Exchange 2013 - Trusted Certificate - Invalid In addition, I would recommend you read the article here which introduces about the Exchange certificate include .local extention. It may not lead to the invalid issue, however it's not the suggested way. Even though it may have been possible for them to be issued an SSL certificate with .local names in it today, when that certificate expires it may not be possible to renew it. Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information. If an Answer is helpful, please click " Accept Answer " and upvote it. Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

I got a issues with my digicert certificate in my clicktests Windows software. Our ClickTest Software user complaint us related to our software. Unauthorised software install in our system. Clicktests software is not authorise Unable to install software. Official Website - https://www.clicktests.com/

Certificate invalid in Exchange 2019

Accepted answer

Joyce Shen - MSFT 16,701 Reputation points

2021-07-01T02:30:03.45+00:00
Hi @Alain Bensimon

Like Andy mentioned above, if we get the invalid status for the certificate imported to Exchange server, we need to make sure the entire chain accessible.

Please use the command below in EMS to get the detailed information of the invalid certificate, you could share the results here, remember to clear your presonal information

Get-ExchangeCertificate -Thumbprint "XXXXXXX" | Format-List

Especially the RootCAType, I see some issue was caused by Unknown RootCA. Just like this thread discussed: Added new SSL cert - showing as "invalid"

Fix this issue and see how it looks

You need the Root CA certificate for this. Check it on the vendor website and get it. You have to import it to the certificate console by the following method
Launch a new Microsoft Management Console (Start -> Run, mmc.exe) and add the Certificates snap-in to it, connecting to the Computer Account for the Local Computer.
Navigate to Trusted Root Certification Authorities. Right-click on Certificates and choose All Tasks and then Import.

And if you have performed the operation correctly above, the status changed to "revocation check failed". Check if the CRL paths in the cerificate can be reached. The paths can be found by opening the certificate, click on Details, scroll to 'CRL Distribution Paths' Here you find a path

CRL Distribution Point
Distribution Point Name:
Full Name:
URL=http://xxx.com/xxx.crl

Then copy the URL en paste it in Internet Explorer. This path must be resolvable.

Refer to this link to get more information: Exchange 2013 - Trusted Certificate - Invalid

In addition, I would recommend you read the article here which introduces about the Exchange certificate include .local extention. It may not lead to the invalid issue, however it's not the suggested way. Even though it may have been possible for them to be issued an SSL certificate with .local names in it today, when that certificate expires it may not be possible to renew it.

Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

1 person found this answer helpful.
Alain Bensimon 46 Reputation points

2021-07-01T13:59:27.46+00:00

Hi @Joyce Shen - MSFT
ok, so first, I don't succeed with the first point Get-ExchangeCertificate -Thumbprint "XXXXXXX" | Format-List.
I have tried to run the command from the exchange server in powershell, but it does not find the certificate. I have replaced the "XXXXX" by the name of my certificate.

So for the second point, I have added the "ca_bundle.crt" in my trusted root certificate authorities, anf after that the status changed to "revocation check failed".
I have checked the CRL with my navigator, and the link resolves (it actually downloaded a crl file on my computer).

But the status still shows "revocation check failed".

Alain Bensimon 46 Reputation points

2021-07-01T15:22:00.26+00:00

after 30 min, the status finally changed to "valid".
Thank you.

Niemann, Benjamin 1 Reputation point

2022-10-13T08:11:02.063+00:00

Thanks,
we had the same problem. This solved it. :)
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Certificate invalid in Exchange 2019

5 additional answers

Your answer