Exchange 2013: Renewing Your Expiring SSL Certificate with the DigiCert Utility

Exchange 2013 SSL

These instructions show you how to use the DigiCert® Certificate Utility for Windows to create your CSR (certificate signing request) and then to install your SSL Certificate. Then, they show how to use the Exchange Admin Center to assign the services to the new SSL Certificate.

To Renew Your Exchange 2013 SSL Certificate:

  1. Create your CSR.

    See Create Your CSR Using the DigiCert Utility.

  2. Install your new SSL Certificate.

    See Import Your SSL Certificate Using the DigiCert Utility.

  3. Configure or assign your new SSL Certificate.

    See Exchange 2013: Assign the Certificate with Exchange Admin Center.

 

1. Create Your CSR with the DigiCert Utility

  1. On your Exchange 2013 server with the expiring certificate, download and save the DigiCert® Certificate Utility for Windows executable (DigiCertUtil.exe).

  2. Run the DigiCert® Certificate Utility for Windows.

    Double-click DigiCertUtil.

  3. In DigiCert Certificate Utility for Windows©, click SSL (gold lock), select the expiring certificate that you want to renew, and then, click Create CSR.

    Create a renewal CSR in Windows

  4. In the "Would you like to import the attributes from 'certificate' into the new CSR?" window, click Yes.

    Create a renewal CSR in Windows

  5. On the Create CSR page, verify that all the certificate details are correct, and then click Generate.

    Create a renewal CSR in Windows

  6. On DigiCert Certificate Utility for Windows© - Renew Certificate page, do one of the following, and then, click Close:

    Click Copy CSR. Copies the certificate contents to the clipboard.
      If you use this option, we recommend that you paste the CSR into a tool such as Notepad.
      If you forget and copy some other item, you still have access to the CSR, and you do not have to go back and recreate it.
       
    Click Save to File. Saves the CSR as a .txt file to the Windows server.
      We recommend that you use this option.
       

    Copy CSR to Clipboard

  7. Order your new SSL Certificate:

    1. Log into your DigiCert Account.

    2. On the My Orders tab, next to the order number for the certificate that you want to renew, click + to expand the options and then, click Renew.

    3. Follow the instructions to renew your certificate.

      During the renewal process, you will be prompted for your CSR. To submit your CSR, you can upload the file that you saved to your Exchange 2013 server, or you can paste the information from the clipboard.

    4. After you place the order to renew your certificate, DigiCert verifies your information.

      If we need any additional information, we will promptly contact you by phone or email. If no additional information is required, we will most likely issue your certificate within an hour.

    Exchange 2013 SSL Certificates & Tutorials

    Buy Now Learn More
 

2. Import Your SSL Certificate with the DigiCert Utility

After DigiCert issues your renewal SSL Certificate, run the DigiCert Certificate Utility to import it to your Exchange 2013 server.

  1. After receiving your new certificate file from DigiCert, save the file to the Exchange 2013 server where you created the CSR.

  2. On the same server, run the DigiCert® Certificate Utility for Windows.

    Double-click DigiCertUtil.

  3. In DigiCert Certificate Utility for Windows©, click SSL (gold lock) and then, click Import.

    DigiCert Utility Import Me

  4. In the Certificate Import wizard, click Browse to browse to the .pfx certificate file (i.e. mail_yourdomain_com.pfx), select the file, and click Open, and then, click Next.

    DigiCert Utility Import Me

  5. In the Password box, enter the password for the .pfx file and then click Next.

    DigiCert Utility Import Me

  6. In the Enter a new friendly name or you can accept the default box, type a friendly name for the certificate.

    Note:    The friendly name is not part of the certificate; instead, it is used to identify the certificate.

    We recommend that you add DigiCert and the expiration date to the end of your friendly name, for example: yoursite-digicert-(expiration date). This information helps identify the issuer and expiration date for each certificate. It also helps distinguish multiple certificates with the same domain name.

    Give SSL Cert a Friendly Name

  7. Click Finish to import the SSL Certificate (.pfx file) to your Exchange 2013 server.

    You should receive a message that the certificate was successfully imported. You should now see your SSL Certificate in the DigiCert Certificate Utility for Windows©, under SSL Certificates.

  8. You can now assign services to your SSL Certificate in the Exchange Admin Center.

 

3. Exchange 2013: Assign the Certificate with Exchange Admin Center

Exchange 2013 SSL
  1. Open the Exchange Admin Center (navigate to https://localhost/ecp).

  2. In Exchange Admin Center, in the menu on the left, click Servers and then in the menu at the top of the Servers section, click Certificates.

    Exchange Admin Center sign in

  3. In the Certificates section, select your newly imported certificate (listed by its Friendly Name) and then, click the Edit symbol (pencil).

  4. On your "Certificate's" page, in the menu on the left, click Services.

    Exchange Admin Center sign in

  5. In the Specify the services that you want to assign this certificate section, check the services (i.e. SMTP, IMAP, POP, and IIS ) that you want to enable for your new SSL Certificate and then, click save.

  6. Your SSL Certificate should now be installed and configured with the services that you selected for use with Exchange 2013.

Test your Installation

To verify that the installation is correct, use our DigiCert® SSL Installation Diagnostics Tool and enter the DNS name of the site (i.e. www.yourdomain.com, or mail.yourdomain.com) that you are securing to test your SSL Certificate.

Troubleshooting

If you run into certificate errors, try repairing your certificate trust errors using DigiCert® Certificate Utility for Windows. If this does not fix the errors contact support.