EXCHANGEUpdated Jun 29, 2026 · 8 min read
Rotate an Exchange certificate safely
Issue a certificate, enable services, update connector identity, and validate mail flow before cleanup.
Before the change
Record the current certificate thumbprint, service assignments, and any send or receive connector bindings that refer to the old certificate.
Get-ExchangeCertificate | Format-List Thumbprint,Subject,Services,NotAfter
Get-SendConnector | Format-List Name,TlsCertificateName
Enable the replacement
Enable-ExchangeCertificate -Thumbprint $newThumbprint -Services IIS,SMTP
Validation
Validate internal and external mail flow, Outlook on the web, Autodiscover, and the SMTP certificate presented by every Exchange endpoint before removing the old certificate.