Exchange Server · Windows app
Exchange certificates, URLs and domains, managed in one place
Exchange Certificate Manager shows every certificate on every Exchange server, gets new ones from your CA, a PFX or Let's Encrypt, and puts them on every server with the right services. It sets every URL on one namespace, changes the default domain and address policy in the right order, and checks the things that usually break: the Auth certificate, missing names and pinned hybrid connectors.
How it works
From expiring to fixed on every server
Nothing changes in Exchange until you confirm it, and every command it runs is logged.
- 1
Connect
It finds your Exchange servers in Active Directory and signs in as you, over Kerberos.
- 2
See everything
Every certificate on every server: days left, issuer, where it's installed and what it's used for.
- 3
Get the certificate
A CSR for your CA with the names read from Exchange, a PFX you already have, or Let's Encrypt.
- 4
Every server
Complete or import once, copy it to the rest, assign services, set the URLs and the default domain everywhere.
- 5
Check and fix
The health check confirms the names, the Auth certificate and the connectors, and fixes what it can.
What you get
No more certificate surprises
The certificate that expired without warning, the name the renewal missed, the server that didn't get it, the hybrid connector still pointing at the old one: each of those is checked for you.
Every server on one screen
Certificates grouped by thumbprint across the organisation, so you see straight away which server is missing one or still uses the old one.
Names read from Exchange
Requests are pre-filled from the internal and external URLs of every virtual directory, Outlook Anywhere and Autodiscover, so a renewal never misses a name.
The Auth certificate
The OAuth certificate behind hybrid free/busy and OWA sign-in is checked on every server, with its expiry. It's the one that catches people out.
Pinned connectors
Send and receive connectors that name a certificate by issuer and subject are checked, so a renewal doesn't quietly break hybrid mail flow.
Let's Encrypt, renewed for you
HTTP validation through IIS on every server, or DNS through Cloudflare for wildcards and servers without port 80. A nightly task renews within 30 days of expiry, running as a gMSA the app can set up for you.
Every URL, one namespace
See every internal and external URL on every server, then set OWA, ECP, EWS, ActiveSync, OAB, MAPI, Outlook Anywhere and Autodiscover in one go, previewed and checked against the certificate first.
Accepted domains, in the right order
Make the public domain the default, update the address policy and apply it as one previewed plan, then retire the AD domain: it checks who still uses it and removes leftover addresses first. Microsoft 365 domains are never touched.
Fixes, not just findings
Renew the Exchange Auth certificate the way Microsoft recommends, or point a hybrid connector at the new certificate, with one click from the health check.
Runs as you, and shows its work
No app registration and no stored passwords. Every Exchange command it runs is in the log, on screen and on disk.
Alerts before anything expires
Email reminders 60, 30, 14, 7, 3 and 1 days before any Exchange certificate expires, from any CA, through Exchange or SMTP2Go. Renewal failures too, and event log entries for your monitoring.
Keeps itself current
Updates from downloads.andykemp.com, checked against their SHA-256 before they replace the app. Or deploy the MSI with Intune and let it manage versions.
Get started
Download and install
Install ExchangeCertManager.msi on an Exchange server or an admin machine. It goes in Program Files with a Start menu shortcut, deploys silently with Intune, and keeps itself up to date. The app on its own, as a single EXE, is on the downloads page.
- A domain-joined Windows 10, 11 or Windows Server 2016+ machine (x64)
- Organization Management, or the Exchange Server Certificates role
- Exchange Server 2016, 2019 or Subscription Edition
- For Let's Encrypt over HTTP: port 80 reaching Exchange
Questions
Frequently asked
Why is the demo a screen tour?
The app talks to Exchange over PowerShell, which a browser can't do. The tour is every screen of the real app, captured with a made-up Contoso organisation, with what each one does.
What do we need to run it?
A domain-joined Windows machine (an Exchange server or an admin workstation) and an account with Organization Management or the Exchange Server Certificates role. Install the MSI (.NET and PowerShell are included), by hand or silently with Intune. A standalone EXE is on the downloads page if you'd rather not install it.
Which Exchange versions does it support?
Exchange Server 2016, Exchange Server 2019 and Exchange Server Subscription Edition (SE), including on Windows Server 2025. Edge Transport servers aren't reachable over the Exchange PowerShell endpoint, so they aren't managed.
Can we use our own CA, or a certificate we already bought?
Yes. Create the request in the app and complete it with your CA's response, or import a PFX you already have. Let's Encrypt is optional.
We're hybrid. Is Let's Encrypt safe for us?
On IIS, yes. Leave SMTP on a commercial certificate: Let's Encrypt certificates change every 60 to 90 days and their issuer can change, and connectors pinned by TlsCertificateName stop matching. The health check spots it if they do.
What does it change?
Only what you ask for: certificates (create, import, assign, remove), virtual directory URLs, accepted domains and address policies, plus a challenge file in IIS or a DNS record in Cloudflare during Let's Encrypt validation. Every change is previewed or confirmed first, and logged.
See every screen before you download
The tour is the real app with a made-up Contoso organisation: the inventory, the health check, URLs, accepted domains, requests, PFX import, deployment and Let's Encrypt, with what each screen does.
Related tools
Use it with
- Win11 Image PrepA Windows app that builds Windows 11 install media with your driver packs already in it: only the editions you deploy, built-in apps removed, unattended or Autopilot setup, and a bootable USB at the end. Try the live demo.
- HAPManA web admin for HAProxy on Ubuntu that puts several servers behind one public IP: HTTPS routed by hostname with the certificates left on your servers, HTTP by Host header and TCP ports such as 25. Health checks, a diff before every change, automatic rollback, history, an audit log, Drain and Maintenance, and Entra ID sign-in.