After creating and applying an address policy in Exchange Server, the SMTP address is not…
How to fix Get-ExchangeCertificate shows blank output
We like to check the Exchange Server certificates. Signing in and checking them in Exchange admin center, everything looks good. But when we run the Get-ExchangeCertificate cmdlet, it shows a blank output. Why is this happening? In this article, you will learn how to fix Get-ExchangeCertificate cmdlet shows blank output.
Table of contents
Get-ExchangeCertificate cmdlet shows empty output
Two Exchange Servers (EX01-2019/EX02-2019) are running in the organization. Let’s run the Get-ExchangeCertificate cmdlet on both Exchange Servers.
Get-ExchangeCertificateThe output on Exchange Server EX01-2019 and EX02-2019 shows an empty output.
Thumbprint Services Subject
---------- -------- -------Why do we get this, and what is the solution for the blank output when running Get-ExchangeCertificate cmdlet?
Solution for Get-ExchangeCertificate shows blank output
The blank output appears because Serialized Payload signing is enabled, and the Exchange Auth certificate is missing or corrupt. If only the Exchange Auth certificate is missing or corrupt, and Serialized payload signing is not enabled, the Get-ExchangeCertificate cmdlet will show values in the output.
Note: Certificate signing of PowerShell serialization payload is now enabled by default since November 2023 Exchange Server Security Updates and higher.
To fix this issue, we have to install a new Exchange Auth certificate on the Exchange Server.
If you already have an Exchange Auth certificate and it shows a blank output when running Get-ExchangeCertificate, it means it’s corrupted.
Important: Did you just install the Exchange Auth certificate? It can take 24 hours before it’s valid. So you have to wait and check later.
1. Check Microsoft Exchange Server Auth certificate
It’s very important that the certificate configured as Auth certificate is valid (not expired) and available on all Exchange Servers (except Edge Transport role and Exchange Management Tools role) within the organization.
Download MonitorExchangeAuthCertificate.ps1 PowerShell script and place it in the folder C:\scripts.
Start Exchange Management Shell and run the below command to check the Exchange Auth certificate status.
Note: To run the script, you must be a member of the Organization Management role group. The script must be run from an elevated Exchange Management Shell (EMS) command prompt on an Exchange Server running the Mailbox role. The script cannot be run on an Exchange Management Tools-only machine.
C:\Scripts\.\MonitorExchangeAuthCertificate.ps1The output shows that the Exchange Auth certificate needs to be replaced by a new one.
Monitor Exchange Auth Certificate script version 23.11.22.1714
The script was run without parameter therefore, only a check of the Auth Certificate configuration is performed and no change will be made
Current Auth Certificate thumbprint: 4010E939A05777DC08A4196830125B2AF2BDFBC1
Current Auth Certificate is valid for -1 day(s)
Exchange Hybrid was detected in this environment
The actively used Auth Certificate is missing on the following servers:
EX01-2019.exoip.local, EX02-2019.exoip.local
Test result: The Auth Certificate in use must be replaced by a new one.
Log file written to: C:\Program Files\Microsoft\Exchange Server\V15\Logging\AuthCertificateMonitoring\AuthCertificateMonitoringLog_20231201153933.txt2. Renew Exchange Auth certificate
Run the below command to renew the Microsoft Exchange Auth certificate.
C:\scripts\.\MonitorExchangeAuthCertificate.ps1 -ValidateAndRenewAuthCertificate $true -IgnoreHybridConfig $true -Confirm:$falseThe output shows that the renewal action was successfully performed.
Monitor Exchange Auth Certificate script version 23.11.22.1714
Mode: Testing and replacing or importing the Auth Certificate (if required)
Renewal scenario: The Auth Certificate in use must be replaced by a new one.
WARNING: Waiting for service 'Microsoft Exchange Service Host (MSExchangeServiceHost)' to start...
The renewal action was successfully performed - the new Auth Certificate will become active on: 12/01/2023 15:43:41
Please ensure to run the Hybrid Configuration Wizard (HCW) as soon as the new Auth Certificate becomes active.
Log file written to: C:\Program Files\Microsoft\Exchange Server\V15\Logging\AuthCertificateMonitoring\AuthCertificateMonitoringLog_20231201154320.txtNote: If you have an Exchange Hybrid configuration, you must rerun the Hybrid Configuration Wizard as soon as the new Auth certificate becomes active. Do that after you verify the Exchange Auth certificate in the next step.
3. Verify Exchange Auth certificate
Run the MonitorExchangeAuthCertificate.ps1 script to check the Exchange Auth certificate.
C:\Scripts\MonitorExchangeAuthCertificate.ps1The output shows that the Auth certificate is valid.
Monitor Exchange Auth Certificate script version 23.11.22.1714
The script was run without parameter therefore, only a check of the Auth Certificate configuration is performed and no change will be made
Current Auth Certificate thumbprint: 6789B2FE30740132E2DDBF147023E7485F476526
Current Auth Certificate is valid for 1826 day(s)
Exchange Hybrid was detected in this environment
Test result: No renewal action is required
Log file written to: C:\Program Files\Microsoft\Exchange Server\V15\Logging\AuthCertificateMonitoring\AuthCertificateMonitoringLog_20231201155121.txt4. Run Get-ExchangeCertificate cmdlet
Run the Get-ExchangeCertificate cmdlet and verify that the output appears with values instead of blank output.
Get-ExchangeCertificateAll the certificates appear in the output and look great.
Thumbprint Services Subject
---------- -------- -------
6789B2FE30740132E2DDBF147023E7485F476526 ....S.. CN=Microsoft Exchange Server Auth Certificate
804F01FADE7DF2AA309277F6BD0F96CF4B3C9B62 IP.WS.. CN=EX02-2019
6BC65424EC1FA8803CDE86F6286518FDB639BFB6 ....... CN=CLIUSR
7EB920C8E05D8DBD0E1CF0C06A584C879F674E60 ....... CN=WMSvc-SHA2-EX02-2019
0014716C6390CFFBA0794248EE248D40129D7020 ....... CN=CLIUSR5. Rerun Hybrid Configuration Wizard
If you have an Exchange Hybrid environment, you need to rerun the Hybrid Configuration Wizard.
6. Check Exchange Server certificate status
Run the Exchange Health Checker script and verify the certificate status.
[PS] C:\scripts>Get-ExchangeServer | ?{$_.AdminDisplayVersion -Match "^Version 15"} | .\HealthChecker.ps1; .\HealthChecker.ps1 -BuildHtmlServersReport -HtmlReportFile "ExchangeAllServersReport.html"; .\ExchangeAllServersReport.htmlThis is how it immediately looks after you install the new Exchange Auth certificate. All the certificate statuses appear as Unknown.
Give it a maximum of 24 hours and run the health checker script again. All the certificate statuses appear as Valid.
That’s it!
Read more: How to export certificate in Exchange Server »
Conclusion
You learned how to fix Get-ExchangeCertificate shows blank output. Run the MonitorExchangeAuthCertificate.ps1 PowerShell script and replace the Exchange Server Auth certificate. Wait a maximum of 24 hours. After that, all the certificates appear valid, and the output works.
Did you enjoy this article? You may also like How to import certificate in Exchange Server. Don’t forget to follow us and share this article.
What Others Are Reading
Still empty output “Get-ExchangeCertificate”. I hope tomorrow it will work.
It will work. You have to give it time.
*topp* ;0)
thank you very much for this article!
The script writes an error:
Unhandled error hit:
A parameter cannot be found that matches parameter name ‘Server’.
The renewal of the certificate failed. Has anyone had a similar experience?
Solved with “Administrator Exchange Powershell” Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn
it’s working now
Thank you for fixing the work that Microsoft screwed up when updating his Exchange 🙂
Great article – Thank you, it is very helpfull