Microsoft Exchange

Windows · Mail server

Replaces the certificate on Exchange services, IIS bindings and send and receive connectors.

What happens

The service agent on the server fetches the task from the appliance over outbound HTTPS, port 443.
Windows basics first import the certificate with an exportable key. Exchange binds it only if its names cover the names the server answers to.
The certificate is enabled for the chosen Exchange services. IIS bindings carrying the previous certificate move when their names are covered or they have no host name. Exchange Back End is preserved. Connectors are updated only when chosen. If it fails: Rollback puts services, IIS bindings and connectors back as they were.
Verification: the package checks names, chain, service selection and IIS bindings, and tests TLS on the selected services. Connector TLS names can also be checked.

Connection: The package runs through the service agent on the server. The agent connects over outbound HTTPS to the appliance, port 443 by default. You open no port into the server.
Service ports: 25, 443, 465, 587, 993, 995
You need: The service agent installed on the server.
Platform: Exchange 2013 and 2016 from CU23, 2019 from CU13 and Subscription Edition, Windows Server 2012 R2 and later
Actions: Discovery, Installation, Verification, Rollback
Packages: exchange2013-2019 1.5.0
Note: Discovery finds the version, server roles, certificates, services, virtual directories and connectors, including Auth, Federation Trust and Edge certificates.
Rollback needs the deployment state and checks that it belongs to this server. Federation Trust is reported but is neither published nor restored by the agent.
Risky changes such as the Auth certificate are off by default. The Edge subscription certificate is left alone.