Skip to content
Andy Kemp Consulting

Requirements#

Where it runs#
Operating system Windows 10 or 11, or Windows Server 2016 or later (x64)
Domain Domain-joined, in or trusted by the Exchange forest
Rights on the machine Local administrator (the app asks to elevate when it starts)
Runtime None: a single self-contained .exe with .NET 8 and PowerShell inside

It runs on an Exchange server or on an admin workstation. On an Exchange server it fills in the server name for you.

Exchange#
Versions Exchange Server 2016, Exchange Server 2019, Exchange Server Subscription Edition (SE)
Servers Mailbox servers. Edge Transport servers aren't reachable over the Exchange PowerShell endpoint and aren't listed.
Endpoint http://<server>/PowerShell, with Kerberos allowed on the PowerShell virtual directory (the default)
Rights Organization Management, or a role group with the Exchange Server Certificates role. The health check also reads virtual directories, connectors and Get-AuthConfig, which View-Only Organization Management covers.

Network#

From the app to Port For
Each Exchange server TCP 80 The Exchange PowerShell endpoint (Kerberos-encrypted)
Domain controllers Kerberos Sign-in
Each Exchange server's c$ share TCP 445 Let's Encrypt HTTP challenge files on remote servers
acme-v02.api.letsencrypt.org, acme-staging-v02.api.letsencrypt.org TCP 443 Let's Encrypt only

Let's Encrypt#

  • HTTP validation: port 80 open from the internet to Exchange for every name on the certificate, and admin rights on each server's Default Web Site folder (local, or through the c$ admin share).
  • DNS validation: access to add TXT records in your public DNS.
  • Automatic renewal: a service account with the Exchange rights above and local administrator on the machine running the task. The app stays in the folder it was registered from.

What it stores#

Where What
C:\ExchangeCertManager\Logs A log file per day, including every Exchange command run
C:\ProgramData\ExchangeCertManager The Let's Encrypt account key (DPAPI-encrypted) and saved renewals. Readable only by Administrators and SYSTEM.
%AppData%\ExchangeCertManager\settings.json The last server, your Let's Encrypt email and the organisation fields for requests

No passwords are stored, apart from the renewal task's, which Windows Task Scheduler holds.