We use SMTP on our Exchange Servers to provide authenticated SMTP email service for those who are using email clients which require SMTP to send email. We had an issue that following a certificate expiry that any SMTP connections to the server (that were attempting to use STARTTLS) would fail. For example:<\/p>\n\n\n\n
$ openssl s_client -starttls smtp exchange1.domain.com:587\nCONNECTED(00000003)\nDidn't find STARTTLS in server response, trying anyway...<\/code><\/pre>\n\n\n\nThe issue was that the old certificates had become invalid, however they were still in use by the SMTP server. We’d already added the new certificate on there ready, we just needed to swap it. You can do this as follows, firstly get the list of certificates installed on the server.<\/p>\n\n\n\n
get-exchangecertificate -server exchange1<\/code><\/pre>\n\n\n\nThe run this to check which is installed on the Exchange server.<\/p>\n\n\n\n
get-receiveconnector \"EXCHANGE1\\Client Frontend EXCHANGE1\" | select *<\/code><\/pre>\n\n\n\nFrom the first command you’ll see a list of Thumbprints, you’ll want to identify which of these you want to use, i.e. your new certificate, once you have found the correct thumbprint:<\/p>\n\n\n\n
$cert = Get-ExchangeCertificate -Thumbprint <as per the output>\n$tlscertificatename = \"<i>$($cert.Issuer)<s>$($cert.Subject)\"<\/code><\/pre>\n\n\n\nFinally you can set the certificate on the receive connector using the following command:<\/p>\n\n\n\n
Set-ReceiveConnector \"EXCHANGE1\\Client Frontend EXCHANGE1\" -TlsCertificateName $tlscertificatename<\/code><\/pre>\n\n\n\nOnce that is done, repeat the test using OpenSSL and you should find the server is responding as expected, you shouldn’t need to restart any services (e.g. Microsoft Exchange Transport Service) for the new certificate to have taken effect.<\/p>\n","protected":false},"excerpt":{"rendered":"
We use SMTP on our Exchange Servers to provide authenticated SMTP email service for those who are using email clients which require SMTP to send email. We had an issue that following a certificate expiry that any SMTP connections to the server (that were attempting to use STARTTLS) would fail. For example: The issue was … Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":4299,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[32,14],"tags":[],"class_list":["post-4294","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-exchange","category-microsoft-windows"],"_links":{"self":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4294","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4294"}],"version-history":[{"count":1,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4294\/revisions"}],"predecessor-version":[{"id":4295,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4294\/revisions\/4295"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/media\/4299"}],"wp:attachment":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4294"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4294"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4294"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}