Renew expired Microsoft Exchange Server Auth Certificate

Today our Exchange servers refused to send out emails to the user mailboxes. After going through the logs, Warnings popped up for Exchange OAuth, which said that SMTPReceive connector was failing because of a certificate issue.

So Exchange server installs a server authentication certificate used for Organizational Authentication for itself and other Exchange servers in the organization for intra-site communication, during initial setup

Usually these certificates have a 5 year validity. Upon expiry, some services start failing to work as needed.

Following the link and steps below, i was able to get  the services up and running again.

ref: https://community.spiceworks.com/topic/512374-missing-the-microsoft-exchange-server-auth-certificate

New-ExchangeCertificate -KeySize 2048 -PrivateKeyExportable $true -SubjectName "cn= Microsoft Exchange Server Auth Certificate" -DomainName "*.yourdomain.com" -FriendlyName "Microsoft Exchange Server Auth Certificate" -Services smtp
Do not accept to replace the SMTP certificate when prompted
2. Note the thumbprint of the new certificate. Let us assume it is 7A39541F8DF58D4821967DD8F899B27410F7C081
3. $a=get-date
4. Set-AuthConfig -NewCertificateThumbprint 7A39541F8DF58D4821967DD8F899B27410F7C081 –NewCertificateEffectiveDate $a
Accept to continue despite the fact that the certificate effective date is not 48 hours into the future
5. Set-AuthConfig –PublishCertificate

6. Make sure to remove any potential reference to the previous certificate (which might not exist anymore) by doing Set-AuthConfig -ClearPreviousCertificate.

Access Denied Error on Exchange Management Shell for Exchange 2013

So I tried opening the EMS tool on our Exchange server and i was getting the dreaded Access Denied error. I was also unable to open the Exchange Toolbox.

First issue i noticed was that the server time was off by 6 minutes. So I got that fixed first.

w32tm is the utility used for that.

But that didnt help with the original error

After having enough of going through the logs for errors, and getting fed up of googling, i came across a forum which talked about two modules used by IIS to support authentication on the Powershell Folders under the Default WebSite, and the Exchange Back-End Site

1. WSMAN
2. KERBAUTH

So I left KERBAUTH module on for the Powershell Folder under Default Website and removed WSMAN module from there.
I enable KERBAUTH and WSMAN for the Powershell folder under Exchange Back-End

Both modules have to be native and local when enabled. You can find them under the Configure Native Modules setting on the right side pane

Its better to run iisreset after any change to the IIS settings to be sure of the effects of your changes.


After setting this combo, both EMS and Toolbox started working.