Exchange Server 2016/2019 Sertifika Yenileme


 Exchange Admin Center (EAC) üzerinden sertifika talebi oluşturma özelliği Exchange Server 2019 CU12 ve Exchange Server 2016 CU23 itibariyle kaldırıldı. Eğer bu CU paketleri veya daha sonraki sürümlere sahipseniz süresi dolan SSL sertifikanızın talebini Exchange Management Shell üzerinden oluştumanız gerekecek. Bu makalede Exchange Management Shell üzerinden sertifika talepleri nasıl oluşturulur,  yeni sertifika nasıl import edilir, sertifikaya servisler nasıl atanır ? konularını ele alacağız. 

Certification Authory (CA) tarafından sağlanan sertifikanın yenileme süreci

Exchange Management Shell kullanarak sertifika yenileme talebi oluşturma

CA için  yeni sertifika talebi oluşturmak için aşağıdaki komutları kullanabiliriz. 

Mevcut sertifikadan üretmek için; 
$request = Get-ExchangeCertificate -Thumbprint 7FDAE73AFFD3A81F2439D84D998AE0E92F1595AC | New-ExchangeCertificate -GenerateRequest 
[System.IO.File]::WriteAllBytes('\\EXCH01\c$\Tools\test.com SAN Cert.req', [System.Text.Encoding]::Unicode.GetBytes($request))
Özelleştirilmiş talep oluşturmak için; 

$request = New-ExchangeCertificate -PrivateKeyExportable $True -GenerateRequest -FriendlyName "Exchange Cert" -SubjectName "C=TR,CN=eposta.test.com,L=ANKARA,O=Test,S=ANKARA" -DomainName autodiscover.test.com,mail.test.com
[System.IO.File]::WriteAllBytes('\\EXCH01\c$\Tools\test.com SAN Cert.req', [System.Text.Encoding]::Unicode.GetBytes($request))
Yeni oluşturduğumuz sertifika talebini Get-ExchangeCertificate komutu ile kontrol edebilirsiniz. 
[PS] C:\Windows\system32>Get-ExchangeCertificate -Thumbprint 2E9376D5A527D06931420573C2B38B11EF024893 | fl


AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule,
                     System.Security.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {mail.test.com, autodiscover.test.com, test.com}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : C=TR, O=TEST, CN=mail.test.com
NotAfter           : 2/28/2024 9:52:57 AM
NotBefore          : 2/28/2023 9:32:57 AM
PublicKeySize      : 2048
RootCAType         : Unknown
SerialNumber       : 71AE277D75E4028B437B0D397838EBA1
Services           : None
Status             : PendingRequest
Subject            : C=TR, O=TEST, CN=mail.test.com
Thumbprint         : 2E9376D5A527D06931420573C2B38B11EF024893

Belirttiğimiz path'deki .req uzantılı dosyayı CA ile paylaşarak yeni sertifikayı talep edeceğiz.  


-----BEGIN NEW CERTIFICATE REQUEST-----
MIID7DCCAtQCAQAwNDEWMBQGA1UEAwwNbWFpbC50ZXN0LmNvbTENMAsGA1UECgwE
VEVTVDELMAkGA1UEBhMCVFIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQCrh6kRCp9d0Ggnl16HaoTBUEsmfYeOl/7LKUZJ3JpsQSxDLAcUk1O6WqAQMgyI
FGjKqRkxEyovifdnvXB5ZmeAAOCfh857fSkeW7UCplmOuku7kGSda2HsC+68ilLm
rQlK5VqJ0spA98W7jDL2zC1OU6ajJfFH1zadbwFlIsq6TSlb8GChLUhj9WV8YGSz
U07yg+Kbn65FVBAlyluCEsiOQwlX+6ryIXISblY7nRtpgcWlEyELZKcDQlxgUqxL
H1gc8qxIWFJrb3zVVogOXT+JEG+jqQZpW8hDLkrD5VoES4KglduGeC/u7lBnuLxn
oW77yJfeU++1k3BtL4/IpOcJAgMBAAGgggFxMBoGCisGAQQBgjcNAgMxDBYKNi4y
LjkyMDAuMjBVBgkrBgEEAYI3FRQxSDBGAgEFDA9FWENIMDEudGVzdC5jb20MDFRF
U1RcRVhDSDAxJAwiTWljcm9zb2Z0LkV4Y2hhbmdlLlNlcnZpY2VIb3N0LmV4ZTBy
BgorBgEEAYI3DQICMWQwYgIBAR5aAE0AaQBjAHIAbwBzAG8AZgB0ACAAUgBTAEEA
IABTAEMAaABhAG4AbgBlAGwAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAA
UAByAG8AdgBpAGQAZQByAwEAMIGHBgkqhkiG9w0BCQ4xejB4MA4GA1UdDwEB/wQE
AwIFoDA5BgNVHREEMjAwghVhdXRvZGlzY292ZXIudGVzdC5jb22CDW1haWwudGVz
dC5jb22CCHRlc3QuY29tMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFG+YjXZDyBNk
bpe1VZ4byUR5GmpbMA0GCSqGSIb3DQEBBQUAA4IBAQAnjEifppS86nHHaXbevIoy
Zpg1M13VuBmtJrx6LnvNWbA/zp8hIQi3twmhxydrRcIEdE6T1LifdFNoWjhZg0rf
faesR+CgIsF/UupHcLD37RzjvfcPciTtUrfGqCEYd8DE/7SBkdL2ya7RgB+SRP2J
DbE/gOP7ThUp+2S7oM3ijzZv9+2Bh+LmG1xeMbA+Iitar+YefHvURFsjW+73fhF8
nMxPEmsMpvxOH1qtR4cW18uAjhPup8BX1QC9zRUVB6kYSmFsr9y/yTEDOP7loQj3
WruxEOfhnZdGLsr1V8qbXDj5oPSdHn5x6F68QFYL/Yrk3NQAoY0n533QCV4sX0kC
-----END NEW CERTIFICATE REQUEST-----

Bekleyen sertifika talebinin tamamlanması

CA trafından aldığımız yeni sertifikamızı aşağıdaki komut yardımıyla import edebiliriz.  

Import-ExchangeCertificate -FileData ([System.IO.File]::ReadAllBytes('\\EXCH01\c$\Tools\test.com Cert.cer')) -Password (ConvertTo-SecureString -String 'P@sswd' -AsPlainText -Force)
Status durumunu "Valid" olarak görmemiz gerekmektedir. 

[PS] C:\Windows\system32>Get-ExchangeCertificate -Thumbprint 2E9376D5A527D06931420573C2B38B11EF024893 | fl


AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule,
                     System.Security.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {mail.test.com, autodiscover.test.com, test.com}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : C=TR, O=TEST, CN=mail.test.com
NotAfter           : 2/28/2024 9:52:57 AM
NotBefore          : 2/28/2023 9:32:57 AM
PublicKeySize      : 2048
RootCAType         : Unknown
SerialNumber       : 71AE277D75E4028B437B0D397838EBA1
Services           : None
Status             : Valid
Subject            : C=TR, O=TEST, CN=mail.test.com
Thumbprint         : 2E9376D5A527D06931420573C2B38B11EF024893

Sertifikaya servislerin atanması

"Valid" duruma geçen sertifikamızı kullanıma almak için servislere assign etmemiz gerekmektedir. Bunun için; 

Enable-ExchangeCertificate -Thumbprint 2E9376D5A527D06931420573C2B38B11EF024893 -Services POP,IMAP,IIS,SMTP
Kontrol için; 

[PS] C:\Windows\system32>Get-ExchangeCertificate -Thumbprint 2E9376D5A527D06931420573C2B38B11EF024893 | fl


AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule,
                     System.Security.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {mail.test.com, autodiscover.test.com, test.com}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : C=TR, O=TEST, CN=mail.test.com
NotAfter           : 2/28/2024 9:52:57 AM
NotBefore          : 2/28/2023 9:32:57 AM
PublicKeySize      : 2048
RootCAType         : Unknown
SerialNumber       : 71AE277D75E4028B437B0D397838EBA1
Services           : IMAP, POP, IIS, SMTP
Status             : Valid
Subject            : C=TR, O=TEST, CN=mail.test.com
Thumbprint         : 2E9376D5A527D06931420573C2B38B11EF024893

Sertifikanın diğer sunuculara eklenmesi

Yeni setifikamızı diğer posta sunucularına da tanıtmamız gerekiyor. Bunun için Export komutu ile dışarıya aktarıyoruz.  

$cert = Export-ExchangeCertificate -Thumbprint 71AE277D75E4028B437B0D397838EBA1 -BinaryEncoded -Password (ConvertTo-SecureString -String 'P@sswd' -AsPlainText -Force)
[System.IO.File]::WriteAllBytes('\\EXCH01\c$\Tools\ExchangeCer.pfx', $cert.FileData)
İmport etmek istdeğimiz sunucuda aşağıdaki komutu çalıştırıyoruz.  

Import-ExchangeCertificate -FileData ([System.IO.File]::ReadAllBytes('\\EXCH01\c$\Tools\ExchangeCer.pfx')) -Password (ConvertTo-SecureString -String 'P@sswd' -AsPlainText -Force)

Teşekkürler.

Yorumlar

Yorum Gönder

Bu blogdaki popüler yayınlar

Reporting Exchange Mail Traffic and Login Statistics with PowerShell

Resim
  In today's work environments, email communication holds critical importance for organizations, creating the need to manage and track usage statistics. In this context, monitoring and reporting the access status and mail traffic of mailboxes on Exchange servers according to specific criteria is crucial for an Exchange administrator. In this blog post, I'll explain in detail how to use the PowerShell script below to collect mailbox access information and mail traffic, and transform this data into a meaningful report. Script Structure The script includes the following sections: 1. Adding Required PowerShell Snap-ins Add-PSSnapin *Exchange* The Add-PSSnapin *Exchange* PowerShell command is used to add the Exchange Management Shell (EMS) module. 2. Initializing Variables with Default Values $global:LogonArray = @() $global:LogonNullArray = @() $progress = 0 ...
Devamı

Bulk Resetting Active Directory User Passwords

Resim
  In your Active Directory environment, resetting the passwords of many users in bulk can be a crucial task to adhere to security policies and keep user accounts secure. In this article, I will demonstrate how to reset the passwords of users in Active Directory in bulk using PowerShell scripts. Preparing the PowerShell Environment: To operate in Active Directory, you can utilize PowerShell. Start a PowerShell session and import the necessary Active Directory module with the following commands: Import-Module ActiveDirectory Resetting Passwords: Resetting Passwords Based on Organizational Unit (OU): To reset user passwords in bulk, you can use the following PowerShell script. This script changes the passwords of all users with a specified password: $NewPassword = ConvertTo-SecureString -String "NewPassword" -AsPlainText -Force $Users = Get-ADUser -Filter * -SearchBase "OU=Users,DC=Example,DC=com" # Specify the ...
Devamı