Mar 102012
 

Wow, what a horrible weekend it has been dealing with all these certificate expirations (both clients, and my own). Ton’s of articles on the internet, however tons don’t cover what you do if you have your own certificate authority and DON’T want to use a self-signed certificate. Also, all the tutorials on the net use the Shell, I rather use the GUI…

When it comes time to renew your certificate, you’ll be seeing these in your Event Viewer:

Source: MSExchangeTransport
Category: TransportService
Event ID: 12018
User (If Applicable): N/A
Computer: server.domain.com  Event Description: The STARTTLS certificate will expire soon: subject: server.domain.com, thumbprint: ZOMGZOMGZOMGZOMGZOMGZOMGZOMGZOMG, hours remaining: 664. Run the New-ExchangeCertificate cmdlet to create a new certificate.

 

Source: MSExchangeTransport
Category: TransportService
Event ID: 12017
User (If Applicable): N/A
Computer: server.domain.com  Event Description: An internal transport certificate will expire soon. ZOMGZOMGZOMGZOMGZOMGZOMGZOMGZOMG, hours remaining: 664  Event Log Name: Application  Event Log Type: error

Anyways, first off, DO NOT use this tutorial if your running “Microsoft Small Business Server”, there is a better, easier, and more automated way to perform this on SBS (I won’t be covering that in this blog post, I will however make another one to explain the procedure). Depending on you’re environment, this may or may not be the best way or the right way to do this. In my environment, I have 1 server that acts as a Domain Controller and a Certificate authority, and a second server that is running Microsoft Exchange 2010.

You take your own risk if you perform the instruction in this blog post.

 

1) Start the renewal process

We need to generate a renewal request. Load up the Exchange Console, and select the “Server Configuration” on the left. It should load up your Exchange Certificates on the lower half of your screen. Look for your certificate that is about to expire. To get the details on the certificates, simply double click and it will load the info, if you’re unsure of which certificate it is, use the thumbprint provided in the Event viewer, and compare it to the Thumbprint on the “Details” tab of the certificate. Once you find it, highlight it and select “Renew Exchange Certificate…” on the action pain to the right.

Renew Exchange Certificate

 

 

 

 

 

 

 

 

2) Create renewal request Wizard

This will open the certificate renewal request wizard (as shown below):

Certificate Renewal Request Wizard

 

 

 

 

 

 

 

Simply choose a file name and location to save the request. It’s easiest just to save it on your desktop. After, hit “Renew”. This will generate the certificate renewal request.

 

3) Copy certificate request to clipboard

Locate the file you created above inside of Windows Explorer. Right click on this file and select “Open”, or “Open With”. When prompted, uncheck the “Always use the selected program to open this kind of file” option, and select “Notepad” as the program to open the file with. Example below:

Open with Notepad

Open with Notepad

 

 

 

 

 

 

 

This will open the certificate request. Now highlight all the text and copy it to your clipboard. Example below:

Certificate request in Notepad

Certificate request in Notepad

 

 

 

 

 

 

 

4) Submit certificate request to certificate authority using web interface

Now we submit the request! Log on to your certificate authority web interface. On the first screen, we will select “Request a certificate”, as shown below:

Request

Request

 

 

 

 

 

 

 

Then select “advanced certificate request”, as shown below:

Advanced certificate request

Advanced certificate request

 

 

 

 

 

 

 

And now, choose “Submit a certificate request by using a base-64 encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.”, again example below:

 

 

 

 

 

Finally, we are going to populate the request. Inside of the “Saved Request:” text box, paste your request from your clipboard (which we copied to your clipboard above), then for “Certificate Template:” choose “Web Server”. Example is below:

 

 

 

 

 

Now select Submit! On the next page that loads, simply select “Download certificate” and save it to a location you’ll remember.

 

5) Install certificate on Exchange

We now have a certificate that’s ready to be installed. Go back to the Exchange console where we left off. Inside of the certificate list, you should see an item that has a status that says something about a pending request. Highlight this request, and on the Action Pane, select “Complete request”. I could be wrong on what this says as I can’t remember and did not take screenshots.

A wizard should open up, in this wizard simply point it to the new certificate (the file we just saved at the end of step 4, shown above). Follow the instructions.

 

6) Assign Services to Certificate

Now that the certificate is installed, we need to assign which services will use it. The new certificate should also now be in the list of certificates inside of Exchange. Highlight the new certificate, right click, and select “Assign Services to Certificate”. Example below:

Assign Services to Certificate

Assign Services to Certificate

 

 

 

 

 

 

 

Once the wizard opens up, follow through and when actually prompted for the services check everything except for “Unified Messaging”. Finish the wizard.

 

7) Delete old certificate

Now we are almost done. Go back to the certificate list inside of Exchange and look for the old certificate that is going to expire. Highlight it, right click, and select “Remove”.

 

You’re Done!

 

  16 Responses to “Renew Exchange 2010 Certificates – Event ID: 12017 & Event ID: 12018”

  1. Hi, i belong “that’s simple”.
    I can’t read the file .req with the Notepad Application.
    Exchange 2010

    Can you Help me ?

    Thanks in Advance.

    Sue

  2. Hello Sue Leon,

    What happens when you try to open it?

    Stephen

  3. @Stephen
    Thx for the procedure 🙂

    @Sue

    The wizard in Exchange 2010 (SP1 ?) exports certificate request in binary format (running the New-ExchangeCertificate cmdlet with the -BinaryEncoded parameter)

    You can import the request directly in the Certificate Authority MMC.

    Then, if you get an error “0x80094801 – The request contains no certificate template information”, you can run the following command on the CA :
    certreq -submit -attrib “CertificateTemplate:WebServer”

    Works fine for me 🙂

    Chris

  4. Oups… Command croped by HTML because of using gt & lt 😉

    certreq -submit -attrib “CertificateTemplate:WebServer” “x:\FullPathToYourRequestFile.req”

  5. Thank you all!! I had the same issue of Sue and thanks to Chris’s suggestion it works great!

  6. Thanks for the information. For my case, I was prompted with certificate status in EMC “The certificate status could not be determined because the revocation check failed”. I could not proceed to assgin service to renewed certification.

    Any solution for this?

  7. Saved my day Stephen. Thank you for such informative article.

  8. Thank you so much for this article..

  9. Yay! Thank you! Other sites had people just questioning why one wouldn’t use a third-party cert. You solved my problem.

  10. Awesome! Thanks for posting this.

  11. Hi,

    We have a few Exchange 2010 servers. My question is do we need to do the renew process n every server?
    Or it is possible to do in on one server, then Export/Import certs to others?

    Thanks,
    Max

  12. Hi Max,

    As far as I know, each exchange server should have it’s own FQDN, therefore I’m guessing that each server will require it’s own certificate.

    I could be wrong, haven’t played too much with multiple Exchange server environments.

  13. MR stephen, i have done with whole proces
    I want to know how to get the certificate which i can install for microsoft outlook on mmc console

  14. Can I use the cert generated from Windows 2003 CA to Exchange 2010 using? Thanks

  15. Hi Tapacwm,

    As far as I know you should be able to. I can’t confirm this, but it shouldn’t matter what the CA is running on…

    Let us know how you make out, as I’m sure some other people might be curious about the same thing.

    Cheers

  16. Thanks for taking the time to do this!!

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

(required)

(required)