Skip to content
Docs sslbrain sslbrain.com

Microsoft Exchange

Copy link to the page “Microsoft Exchange”

← All integrations

Windows · Mail server

Replaces the certificate on Exchange services, IIS bindings and send and receive connectors.

The service agent on the server fetches the task from the appliance over outbound HTTPS on port 443 and installs the certificate locally on the server. The appliance never connects to the server.

What happens

  1. The service agent on the server fetches the task from the appliance over outbound HTTPS, port 443.
  2. Windows basics first import the certificate with an exportable key. Exchange binds it only if its names cover the names the server answers to.
  3. The certificate is enabled for the chosen Exchange services. IIS bindings carrying the previous certificate move when their names are covered or they have no host name. Exchange Back End is preserved. Connectors are updated only when chosen. If it fails: Rollback puts services, IIS bindings and connectors back as they were.
  4. Verification: the package checks names, chain, service selection and IIS bindings, and tests TLS on the selected services. Connector TLS names can also be checked.

Technical details

Connection
The package runs through the service agent on the server. The agent connects over outbound HTTPS to the appliance, port 443 by default. You open no port into the server.
Service ports
25, 443, 465, 587, 993, 995
You need
The service agent installed on the server.
Platform
Exchange 2013 and 2016 from CU23, 2019 from CU13 and Subscription Edition, Windows Server 2012 R2 and later
Actions
Discovery, Installation, Verification, Rollback
Packages
exchange2013-2019 1.7.0
Note
  • Auth, Federation and EdgeSync require RSA 2048, 3072 or 4096 bits. IIS, SMTP, POP and IMAP also accept ECDSA P-256/P-384 with the November 2024 SU or later and EnableEccCertificateSupport=1; Exchange 2013 and older SU levels require RSA. IIS with AD FS claims authentication requires RSA. Discovery reads the ExSetup version and registry setting; deployment checks them again before changing bindings or connectors. The EdgeSync certificate is not replaced. Microsoft: https://learn.microsoft.com/en-us/exchange/architecture/client-access/certificates
  • Discovery finds the version, server roles, certificates, services, virtual directories and connectors, including Auth, Federation Trust and Edge certificates.
  • Rollback needs the deployment state and checks that it belongs to this server. Federation Trust is reported but is neither published nor restored by the agent.
  • Risky changes such as the Auth certificate are off by default. The Edge subscription certificate is left alone.

Get started