How to renew the Exchange Edge Server SMTP certificate

Although it's not a mandatory role, the Exchange Edge server is one of the best SMTP relays and security servers available. It can be the entrance point of your organization, while also filtering and securing the messages that flow inside.

The Exchange Edge server needs a certificate assigned to the SMTP service that can be used to achieve secure connections with outside servers or for authentication with the inside HUB transport server, if there's an Edge subscription in place.

If you're using the self-signed certificate and it's approaching the expiration date, now it's probably the time to renew it. In order to do that, follow these steps:

  1. Open the Exchange Management Shell and run the following cmdlet: Get-ExchangeCertificates.
  2. Copy the thumbprint and then run this command: Get-ExchangeCertificate -Thumbprint  | New-ExchangeCertificate.
  3. Run Get-ExchangeCertificates again and copy the new thumbprint.
  4. Enable the certificate for SMTP: Enable-ExchangeCertificate -Services:"SMTP".

We now need to rebuild the Edge subscription:

  1. On the Edge server run: New-EdgeSubscription –FileName "C:\EdgeSubscription.xml".
  2. Copy the EdgeSubscription.xml file to the internal Hub Transport server.
  3. On the Hub Transport server remove the existing subscription, by using the Exchange Management Console (Organization > Hub Transport) or by runing the cmdlets Get-EdgeSubscription and then Remove-EdgeSubscription.
  4. Create the new Edge subscription by using the EMC or by using PowerShell: New-EdgeSubscription -FileName "C:\EdgeSubscription.xml".

About The Author

2 thoughts on “How to renew the Exchange Edge Server SMTP certificate”

  1. If you remove edge subscription from hub transport you will lost all messages in queus on EDGE servers. You shouldn’t remove you must just update…

  2. It’s pretty clear that the person that wrote this article has not actually run these commands on real Edge/Hub Transports or they’d have seen the errors generated.

Leave a Comment

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top