{"id":28,"date":"2010-12-28T12:45:39","date_gmt":"2010-12-28T10:45:39","guid":{"rendered":"http:\/\/exchangetimes.wordpress.com\/?p=28"},"modified":"2010-12-28T12:45:39","modified_gmt":"2010-12-28T10:45:39","slug":"renewing-tls-certificate-on-a-hub-transport-server","status":"publish","type":"post","link":"https:\/\/exchangetimes.net\/?p=28","title":{"rendered":"Renewing TLS Certificate on a Hub Transport Server"},"content":{"rendered":"

I received\u00a0an event today advising me that the local TLS certificate has expired and needs to be renewed. Here is the event info.<\/p>\n

\"\"<\/a>
TLS Cert Expired Event<\/figcaption><\/figure>\n
We need to renew this Certificate otherwise mailflow in Exchange 2007 will stop working. To do this open Exchange Management Shell and type the following:<\/div>\n
Get-ExchangeCertificate | fl<\/strong><\/em><\/div>\n
You will be presented with all the certs installed on the server. You need to now find the cert that has expired. An example of an expired cert is:<\/div>\n
AccessRules\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : {System.Security.AccessControl.CryptoKeyAccessRule, System
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 .Security.AccessControl.CryptoKeyAccessRule, System.Securi
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ty.AccessControl.CryptoKeyAccessRule}
\nCertificateDomains\u00a0: {XXXX01, XXXX01.domainname.local}
\nHasPrivateKey\u00a0\u00a0\u00a0\u00a0\u00a0 : True
\nIsSelfSigned\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : True
\nIssuer\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : CN=SERVER01
\nNotAfter\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 2010\/12\/28 09:33:12 AM
\nNotBefore\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 2009\/12\/28 09:33:12 AM
\nPublicKeySize\u00a0\u00a0\u00a0\u00a0\u00a0 : 2048
\nRootCAType\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : Unknown
\nSerialNumber\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 8E1600C9A48960A64F515084A643CF4D
\nServices\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : SMTP
\nStatus\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : Invalid<\/span><\/strong>
\nSubject\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : CN=SERVER01
\nThumbprint\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 459CA3A8D2CE3A300839D6254ACD4A5642F25185<\/div>\n
The easiest way to renew the above certificate is to export the first cmdlet we ran to a text file and then copying the cert. To do that do the following:<\/div>\n