Installing and deploying#
Exchange Certificate Manager comes two ways from downloads.andykemp.com:
| Download | Use it for |
|---|---|
ExchangeCertManager.exe |
Running it straight away on one machine. File > Install on this Server copies it to Program Files later if you want. |
ExchangeCertManager.msi |
Installing on several machines, or deploying with Intune, Configuration Manager or Group Policy. |
Both install to the same place, C:\Program Files\Andy Kemp Consulting\Exchange Certificate Manager, with a Start menu shortcut. The app's data (logs, the Let's Encrypt account key, saved renewals and the Cloudflare token) is kept in C:\ProgramData\ExchangeCertManager and is left in place when the app is uninstalled.
The MSI#
# Interactive (asks for administrator rights)
msiexec /i ExchangeCertManager.msi
# Silent
msiexec /i ExchangeCertManager.msi /qn
# Silent, with the in-app updater turned off: new versions come from your deployment tool
msiexec /i ExchangeCertManager.msi /qn UPDATES=0
# Uninstall
msiexec /x ExchangeCertManager.msi /qn
A newer MSI upgrades an older one in place, and the renewal task keeps working because the path doesn't change.
UPDATES=0 writes Updates = 0 under HKLM\SOFTWARE\Andy Kemp Consulting\Exchange Certificate Manager. The app then doesn't offer updates; Tools > Check for updates says they're managed by your organisation. Leave it out (or set UPDATES=1) and the app updates itself from downloads.andykemp.com as usual.
Deploying with Intune#
The MSI can go in as a Line-of-business app (upload the .msi, Intune reads the product code and detects it for you), or as a Windows app (Win32) if you want to control the command line:
| Setting | Value |
|---|---|
| Install command | msiexec /i ExchangeCertManager.msi /qn UPDATES=0 |
| Uninstall command | msiexec /x ExchangeCertManager.msi /qn |
| Install behaviour | System |
| Detection | MSI product code (filled in from the MSI), or the file C:\Program Files\Andy Kemp Consulting\Exchange Certificate Manager\ExchangeCertManager.exe |
| Requirements | Windows 10/11 or Windows Server 2016+, 64-bit |
Assign it to the admin workstations or Exchange servers that need it. With UPDATES=0, publish each new MSI as a new version of the app (supersedence) to roll it out.
Code signing#
Release builds are signed with Andy Kemp Consulting Ltd's code-signing certificate (Azure Artifact Signing) once signing is enabled for the project, so Windows shows the publisher instead of "unknown publisher". To check a file:
Every download also has a SHA-256 checksum on downloads.andykemp.com.