Remove certificate in Exchange Server

There are two methods to remove an Exchange Server certificate. The first method is to delete the certificate in Exchange server with Exchange Admin Center (EAC). The second method is to remove the certificate with PowerShell. Before we start, did you assign a new certificate to the Exchange services? We recommend waiting a week before removing the certificate. If the certificate is assigned to Exchange services, the certificate can’t be removed.

Remove certificate in Exchange admin center

Let’s look at how to remove the Exchange certificate in Exchange admin center with the below steps:

1. Sign in to Exchange Admin Center
2. Click servers > certificates
3. Select the certificate that you like to remove from the list view
4. Click the delete icon

Note: Ensure another certificate is installed and assigned to the Exchange services before you press delete.

5. A warning shows up if you are sure to remove the certificate
6. Click OK

7. The Exchange certificate is successfully removed

Didn’t you get an error message that it’s not possible to remove the certificate? Then you can assume that you did remove the certificate in Exchange Server successfully. It’s always good to double-check. In the next step, we will verify that the certificate is removed from the Exchange Server.

Read more: A special rpc error occurs on server »

8. Check the installed certificates in Exchange Server and confirm that the certificate doesn’t appear in the list

Do you have more than one Exchange Server running in the organization? Repeat the steps described in this article on the remaining Exchange Servers.

Remove Exchange certificate with PowerShell

In the below steps, you will learn how to remove an Exchange certificate with PowerShell.

Get Exchange certificate

It’s good to get a list of the installed Exchange certificates first. After that, we will remove the certificate. Read the article Get Exchange certificate with PowerShell for more information.

Run Exchange Management Shell as administrator and run the Get-ExchangeCertificate cmdlet.

[PS] C:\>Get-ExchangeCertificate | select Thumbprint, Services, NotAfter, Subject, CertificateDomains | fl


Thumbprint         : 1AEF337DFC2B537D9E0D0C89D1AE55749AF2660B
Services           : SMTP
NotAfter           : 5/1/2027 9:15:30 PM
Subject            : CN=Microsoft Exchange Server Auth Certificate
CertificateDomains : {}

Thumbprint         : E55A7CE736B5798A1A694F1D0515227E35F97514
Services           : IIS, SMTP
NotAfter           : 5/1/2027 7:53:26 PM
Subject            : CN=EX01-2019
CertificateDomains : {EX01-2019, EX01-2019.exoip.local}

Thumbprint         : E0BDD1F47CA74B3FC3E6D84DD4AF86C1E7141DC9
Services           : IMAP, POP, IIS, SMTP
NotAfter           : 7/19/2022 11:14:01 AM
Subject            : CN=mail.exoip.com
CertificateDomains : {mail.exoip.com, autodiscover.exoip.com}

Thumbprint         : 5C542FF3253B641876C77C70404625154B723E25
Services           : None
NotAfter           : 4/13/2032 5:38:47 PM
Subject            : CN=WMSvc-SHA2-EX01-2019
CertificateDomains : {WMSvc-SHA2-EX01-2019}

We have four Exchange certificates installed on the Exchange Server. Three certificates are bound to the SMTP service.

Note: Certificates bound to the service SMTP are a little different than other services on an Exchange server. For example, if you bind a certificate to the service IIS, it removes the binding for any previous certificate and becomes the only certificate bound to that service. With SMTP, you can have multiple SSL certificates bound to the service.

Do you already know which Exchange certificate you need to remove? Then, let’s find out how to remove the Exchange certificate in the next step.

Remove Exchange certificate

We did run the Get-ExchangeCertificate cmdlet. After that, we know which certificate we want to remove. The certificate that we want to remove is the local certificate with thumbprint E0BDD1F47CA74B3FC3E6D84DD4AF86C1E7141DC9.

Note: Don’t remove the certificate until you’re 100% sure you don’t need it. It’s better to leave the certificate for a week or more before removing it.

Run the Remove-ExchangeCertificate cmdlet, press Y to confirm, and press Enter.

[PS] C:\>Remove-ExchangeCertificate -Thumbprint E0BDD1F47CA74B3FC3E6D84DD4AF86C1E7141DC9

Confirm
Are you sure you want to perform this action?
Remove certificate with thumbprint E0BDD1F47CA74B3FC3E6D84DD4AF86C1E7141DC9 from the computer's certificate store?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [?] Help (default is "Y"): Y

The certificate with thumbprint E0BDD1F47CA74B3FC3E6D84DD4AF86C1E7141DC9 is removed successfully.

Keep reading: Install FREE Let’s Encrypt certificate in Exchange Server »

Conclusion

You learned how to remove a certificate in Exchange Server. Remember that you don’t remove the certificate immediately. Make sure that you assign another certificate to the Exchange services. Wait it out and remove the certificate, for example, after a week.

Unfortunately, you can’t unbind the service from the certificate. Instead, you have to re-assign the services to another certificate first. After that, you can remove the certificate.

I hope that this article helped you to remove the Exchange certificate in Exchange Server. What do you prefer, removing the certificate in Exchange Admin Center or with PowerShell?

Did you enjoy this article? You may also like Install Exchange certificate with PowerShell. Don’t forget to follow us and share this article.