Exchange Server · Windows app
Exchange certificates, requested, deployed and checked in one place
Exchange Certificate Manager shows every certificate on every Exchange server, gets new ones from your CA, a PFX or Let's Encrypt, puts them on every server with the right services, and checks the things that usually break: the Auth certificate, missing names and pinned hybrid connectors.
How it works
From expiring to fixed on every server
Nothing changes in Exchange until you confirm it, and every command it runs is logged.
- 1
Connect
Sign in as you, over Kerberos, to any Mailbox server. It finds every Exchange server in the organisation.
- 2
See everything
Every certificate on every server: days left, issuer, where it's installed and what it's used for.
- 3
Get the certificate
A CSR for your CA with the names read from Exchange, a PFX you already have, or Let's Encrypt.
- 4
Every server
Complete or import once, then copy it to the rest and assign IIS, SMTP, IMAP or POP everywhere.
- 5
Check
The health check confirms the names, the Auth certificate and the connectors are all right.
What you get
No more certificate surprises
The certificate that expired without warning, the name the renewal missed, the server that didn't get it, the hybrid connector still pointing at the old one: each of those is checked for you.
Every server on one screen
Certificates grouped by thumbprint across the organisation, so you see straight away which server is missing one or still uses the old one.
Names read from Exchange
Requests are pre-filled from the internal and external URLs of every virtual directory, Outlook Anywhere and Autodiscover, so a renewal never misses a name.
The Auth certificate
The OAuth certificate behind hybrid free/busy and OWA sign-in is checked on every server, with its expiry. It's the one that catches people out.
Pinned connectors
Send and receive connectors that name a certificate by issuer and subject are checked, so a renewal doesn't quietly break hybrid mail flow.
Let's Encrypt, renewed for you
HTTP validation through IIS on every server, so it works behind a load balancer, or DNS for wildcards. A nightly task renews within 30 days of expiry.
Runs as you, and shows its work
No app registration and no stored passwords. Every Exchange command it runs is in the log, on screen and on disk.
Get started
Download and run
Download ExchangeCertManager.exe from GitHub, put it somewhere permanent such as C:\ExchangeCertManager, and run it on an Exchange server or an admin machine. There is nothing to install.
- A domain-joined Windows 10, 11 or Windows Server 2016+ machine (x64)
- Organization Management, or the Exchange Server Certificates role
- Exchange Server 2016, 2019 or Subscription Edition
- For Let's Encrypt over HTTP: port 80 reaching Exchange
Questions
Frequently asked
Why is the demo a screen tour?
The app talks to Exchange over PowerShell, which a browser can't do. The tour is every screen of the real app, captured with a made-up Contoso organisation, with what each one does.
What do we need to run it?
A domain-joined Windows machine (an Exchange server or an admin workstation) and an account with Organization Management or the Exchange Server Certificates role. The download is a single exe with .NET and PowerShell included.
Which Exchange versions does it support?
Exchange Server 2016, Exchange Server 2019 and Exchange Server Subscription Edition (SE), including on Windows Server 2025. Edge Transport servers aren't reachable over the Exchange PowerShell endpoint, so they aren't managed.
Can we use our own CA, or a certificate we already bought?
Yes. Create the request in the app and complete it with your CA's response, or import a PFX you already have. Let's Encrypt is optional.
We're hybrid. Is Let's Encrypt safe for us?
On IIS, yes. Leave SMTP on a commercial certificate: Let's Encrypt certificates change every 60 to 90 days and their issuer can change, and connectors pinned by TlsCertificateName stop matching. The health check spots it if they do.
What does it change?
Only what you ask for: creating, importing, assigning and removing Exchange certificates, plus a challenge file in IIS during Let's Encrypt validation. Every change is confirmed first and logged.
See every screen before you download
The tour is the real app with a made-up Contoso organisation: the inventory, the health check, requests, PFX import, deployment and Let's Encrypt, with what each screen does.