Exchange Server: Automating SSL/TLS Certificates with simple-acme

This guide demonstrates how to configure automated SSL/TLS certificate renewal on Exchange Server using simple-acme. This setup ensures you never have to worry about manual certificate renewal, installation, or service binding again.

Why use ACME for Exchange?

• Automated renewal – certificates are renewed and provisioned without manual intervention.
• No CSR generation – the ACME protocol handles key pair generation and certificate issuance automatically.
• No downtime – the certificate is automatically bound to IIS, SMTP, IMAP, and POP services.
• Eliminate human error – removes the risk of expired certificates disrupting mail flow.

Prerequisites

• Exchange Server 2013, 2016, or 2019.
• Windows Server with administrator privileges.
• DNS hostnames (e.g. mail.fairssl.dk, autodiscover.fairssl.dk) pointing to the server.
• An ACME account with a Certificate Authority (such as Let's Encrypt or FairSSL).

Step 1 – Download and install simple-acme

Download simple-acme from simple-acme.com and extract it to C:\simple-acme or %ProgramFiles%\simple-acme.

Step 2 – Choose a Domain Validation Method

The ACME protocol requires proof of domain ownership before a certificate can be issued. There are two primary methods:

HTTP-01 Validation

The CA verifies the domain by requesting a specific file from your web server over HTTP port 80.

• Requirements: Port 80 must be open and accessible from the internet.
• Pros: Straightforward setup – simple-acme handles this automatically via IIS.
• Cons: Does not support wildcard certificates or servers behind restricted firewalls/load balancers.

Use the --validation selfhosting parameter in your simple-acme command.

DNS-01 Validation

The CA verifies the domain by checking a TXT record in your DNS configuration.

• Requirements: API access to your DNS provider (e.g. Cloudflare, Azure DNS, Route53).
• Pros: Works behind firewalls, with load balancers, and supports wildcard certificates.
• Cons: Requires DNS API integration.

Use the --validation dns-01 parameter alongside the relevant DNS plugin.

Step 3 – Provision the certificate with simple-acme

Open the Exchange Management Shell as an administrator and navigate to your simple-acme directory.

Run the following command (adjusting hostnames and validation to match your environment):

Using Let's Encrypt (Free DV Certificate)

wacs.exe --source manual --host "mail.eksempel.dk,autodiscover.eksempel.dk" --csr rsa --validation selfhosting --certificatestore My --acl-fullcontrol "network service,administrators" --installation iis,script --script "./Scripts/ImportExchange.v2.ps1" --scriptparameters "'{CertThumbprint}' 'IIS,SMTP,IMAP,POP' 1 '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'" --friendlyname "mail.eksempel.dk" --accepttos

Replace --validation selfhosting with --validation dns-01 --dnsPlugin cloudflare (or your specific DNS provider) if using DNS validation.

Using FairSSL ACME (OV/DV Certificate)

wacs.exe --baseuri "https://fairssl.dk/acme" --eab-key-identifier DIN_EAB_KID --eab-key DIN_EAB_HMAC --source manual --host "mail.eksempel.dk,autodiscover.eksempel.dk" --csr rsa --validation none --certificatestore My --acl-fullcontrol "network service,administrators" --installation iis,script --script "./Scripts/ImportExchange.v2.ps1" --scriptparameters "'{CertThumbprint}' 'IIS,SMTP,IMAP,POP' 1 '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'" --friendlyname "mail.eksempel.dk" --accepttos

Your EAB KID and HMAC key are available in your FairSSL control panel after ordering an ACME certificate.

Parameter Overview

Step 4 – Verify Exchange Services

Run the following in the Exchange Management Shell to verify the certificate is active:

Get-ExchangeCertificate

The new certificate should display IPWS (or similar) under the Services column – indicating that IIS, POP, Web, and SMTP are correctly bound.

Get-WebBinding

Confirm that the Default Web Site is using the new certificate.

Step 5 – Verify IIS Bindings

Open IIS Manager and check the following:

• The Default Web Site must be using the new ACME certificate.
• The Exchange Back End site must continue to use the internal Exchange certificate (typically named "Microsoft Exchange").

Warnings

Troubleshooting

• Certificate installed but services not working: Ensure the ImportExchange.v2.ps1 script executed correctly. Run Get-ExchangeCertificate to check service activation.
• HTTP-01 validation fails: Port 80 is likely blocked by a firewall. Switch to DNS-01 or use FairSSL Auto-DNS instead.
• Renewal fails silently: Check the log files in the simple-acme directory. Run wacs.exe --renew --force manually to test the renewal process.

wacs.exe --verbose