Remove a certificate from a service

Patrick Alley

unread,

Dec 17, 2008, 11:04:07 AM12/17/08

to

I have accidentally enabled the wrong certificate for the SMTP service. I
have tried removing the certificate, importing it again, and re-enabling it
without SMTP specified but it retains the original services which included
SMTP.

Is there anyway to remove this certificate from the SMTP service so the
system will use the self-signed?

Thanks!

----------------------
Patrick Alley, MCSE

Wayne Hollomby

unread,

Dec 17, 2008, 11:19:49 AM12/17/08

to

If this is for Exchange 2007 you need to use the enable-exchangecertificate
powershell command

http://technet.microsoft.com/en-us/library/aa997231.aspx

Use get-exchangecertificate to show you which certifcate has SMTP enabled
and to get the thumbprint for each certifcate also

Wayne
"Patrick Alley" <Patric...@discussions.microsoft.com> wrote in message
news:73F95BD4-3BBB-4898...@microsoft.com...

Lanwench [MVP - Exchange]

unread,

Dec 17, 2008, 11:10:19 AM12/17/08

to

Hmmm. You generally set up certificates in IIS, not Exchange. What versions
& SPs of everything, where are you seeing errors, and what is the
certificate for?

Oliver Moazzezi [MVP]

unread,

Dec 17, 2008, 11:35:01 AM12/17/08

to

I think he's talking about Exchange 2007, where you have to enable the cert
for use via Powershell. I would follow Wayne Hollombys advice here.

Oliver

Patrick Alley

unread,

Dec 17, 2008, 11:46:01 AM12/17/08

to

I apologize for not specifying this.

I am running Exchange 2007 SP1 (w/rollup 4). This is my SAN (subject
alternative name) certificate that I am using for POP, IMAP, and IIS. I
enabled it through powershell but I spaced and added SMTP to the services I
was enabling it for. Problem is that my internal FQDN is not specified in
this cert so my Outlook 2007 client are complaining about the certificate.

My goal is to get my SMTP service back to using the self-signed certificate
that Exchange generated.

Thanks.

----------------------
Patrick Alley, MCSE

Patrick Alley

unread,

Dec 17, 2008, 11:54:24 AM12/17/08

to

Thank you.

This is the method I used to enable the certificate originally. Problem is
that I enabled it for SMTP when I did not need to. Now I cannot remove it
from the SMTP service.

----------------------
Patrick Alley, MCSE

Andy David {MVP}

unread,

Dec 17, 2008, 1:13:43 PM12/17/08

to

On Wed, 17 Dec 2008 08:54:24 -0800, Patrick Alley
<Patric...@discussions.microsoft.com> wrote:

>Thank you.
>
>This is the method I used to enable the certificate originally. Problem is
>that I enabled it for SMTP when I did not need to. Now I cannot remove it
>from the SMTP service.

Why dont you want it enabled for SMTP?

Patrick Alley

unread,

Dec 17, 2008, 2:12:09 PM12/17/08

to

The certificate does not contain the internal FQDN for my Exchange server.
This is causing my Outlook 2007 clients to complain. I could disable
encryption on the clients to resolve this but I don't want to go there if I
don't have to.

----------------------
Patrick Alley, MCSE

Andy David {MVP}

unread,

Dec 17, 2008, 2:31:21 PM12/17/08

to

On Wed, 17 Dec 2008 11:12:09 -0800, Patrick Alley
<Patric...@discussions.microsoft.com> wrote:

>The certificate does not contain the internal FQDN for my Exchange server.
>This is causing my Outlook 2007 clients to complain. I could disable
>encryption on the clients to resolve this but I don't want to go there if I
>don't have to.

Well, the "new-exchangecertificate" ( with no other switches) command
should automatically create a self-signed cert and prompt you to
overwrite the existing one for SMTP. I would double check to make sure
the other services are still set for the other cert after that.

Patrick Alley

unread,

Dec 19, 2008, 10:48:13 AM12/19/08

to

The problem is not with creating the self-signed certificate. I can create
the certificate without issue but when I try to enable it for SMTP with the
-services switch, I receive a message stating that the 3rd party certificate
takes precedence.

The kicker is that if I remove the certificate completely, import it again,
and then try to only enable it for POP, IMAP, and IIS, it will still grab
SMTP like it is retaining the information from before I removed it. I am not
sure where it is getting this information because I have checked the
certificate store on the server before and after running the
remove-exchangecertificate cmdlet and found that the certificate is being
removed from the server's store when the cmdlet is run.

Wayne Hollomby

unread,

Dec 22, 2008, 5:01:36 PM12/22/08

to

have you tried doing

enable-exchangecertificate -thumbprint "thumbprint of self signed
cert" -services none

this should remove all services from that cert

Wayne
"Patrick Alley" <Patric...@discussions.microsoft.com> wrote in message

news:D9972A41-65D7-4BBB...@microsoft.com...