Unable to remove services from Exchange certificate in ECP

Question

Hi, i have a situation in Exchange 2016 and SE where we renewed a certificate in ECP but we're unable to remove imap and pop3 from the old one or the new one, the checkboxes are checked but completely greyed out. We've tried using the powershell command to just assign it to iis and smtp which goes though just fine, no errors, but it keeps showing as selected for pop and imap.

And PowerShell is showing as assigned for the services.

The environment has both Exchange 2016 CU23 and in the process of migrating to SE.

Answer 1

In Exchange, once a certificate has been assigned to a service, that service checkbox in ECP can’t be cleared; the only supported action is to assign a different certificate to that service. The greyed‑out checkboxes you see are expected behavior.

Key points from the product behavior:

1. Service assignments are one‑way in ECP/PowerShell
   • After a certificate is assigned to a service, the assignment itself cannot be “removed” from that certificate.
   • To stop using a certificate for a given service, assign another certificate to that service instead, then remove the old certificate if it’s no longer needed.
   • This is explicitly documented: “Once you assign a certificate to a service, you can't remove the assignment. If you no longer want to use a certificate for a specific service, you need to assign another certificate to the service, and then remove the certificate that you don't want to use.”
2. What this means for POP/IMAP in your scenario
   • If POP and IMAP are still shown as selected for both the old and new certificates:
     • Pick the certificate you actually want POP/IMAP to use (typically the new one).
     • Ensure that certificate is assigned to POP and IMAP (which you’ve already done via PowerShell).
     • For the old certificate, you will not be able to uncheck POP/IMAP; instead, remove the old certificate entirely once it is no longer in use by any other components (for example, not referenced by Send connectors via TlsCertificateName).
3. Verifying and cleaning up via PowerShell
   • Confirm which services each certificate is actually bound to:

          Get-ExchangeCertificate | Format-List FriendlyName,Thumbprint,Services
     

   • If the old certificate is no longer needed for any service, remove it:

          Remove-ExchangeCertificate -Thumbprint <old-cert-thumbprint>
     

   • If you get an error about Send connectors when removing a certificate, follow the documented process to clear and re‑set TlsCertificateName on the affected Send connectors, then remove the old certificate and re‑assign TlsCertificateName to the new certificate.
4. POP/IMAP specific note
   • For POP and IMAP, the certificate assignment is only part of the configuration. The FQDN that clients use is controlled by Set-PopSettings and Set-ImapSettings. Even if multiple certificates appear to have POP/IMAP checked, clients will use the certificate that matches the FQDN configured for those services.

In summary, the greyed‑out checkboxes are by design. The supported way to “remove” POP/IMAP from a certificate is to:

1. ensure another certificate is assigned and in use for those services, and then
2. remove the old certificate from the server if it is no longer required.

---

References:

• Assign certificates to Exchange Server services
• Digital certificates and encryption in Exchange Server
• Can't remove a certificate that's installed in Exchange Server

Answer 2

Hi Raymond Brooks

To better clarify this concern then better assist you, could you please provide the additional information below:

1. What is the exact end-goal?

Are you trying to truly disable POP/IMAP protocol access in the org, or just remove POP/IMAP from the certificate so the old cert can be cleaned up?

1. What do the certificates show side-by-side in PowerShell?

Can you paste the output of: Get-ExchangeCertificate | fl FriendlyName,Thumbprint,Subject,NotAfter,Services for both the old and new certificates, and the exact Enable-ExchangeCertificate … -Services … commands you ran?

1. Which service is still actually using the old certificate (if any), and on which server?

I am looking forward to hearing from you

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.