Exchange 2019 switching from self-signed to 3rd party certificate

@Susan Dodds Yes, two namespaces (aka domains) are all you need in Exchange Server:

autodiscover.contoso.com
mail.contoso.com

You can create a CSR for your CA using the Exchange Server 2019 EAC.

Hi @Susan Dodds

Thank you for reaching out. I understand your concern about the potential impact of switching from a self-signed certificate to a new one on your Exchange Server 2019 CU14 and I'm happy to help clear things up for you. 

The good news is that this switch should not cause any issues with your existing Outlook or phone email client profiles, they will stay exactly as they are. 

The only thing users will notice is a one-time security alert the first time they connect after the new certificate is installed. This happens because the server now presents a different "identity" with the new certificate. To continue, users simply need to approve the new certificate when prompted. After that, everything should work exactly the same as before, with no need to recreate any profiles. 

Please keep in mind that clients won’t automatically trust the new certificate, so this manual approval step is necessary. 

To make sure all Exchange services, like OWA, ActiveSync, and Autodiscover, work perfectly, the new certificate must include these two hostnames: 

• autodiscover.contoso.com 
• mail.contoso.com 

Here’s a quick action plan to guide you through the process. For more detailed and reliable instructions, I highly recommend the official Microsoft documentation, which covers every step thoroughly. 

• Create a Certificate Signing Request (CSR): You'll need to generate a new CSR on your Exchange Server to request a trusted SSL certificate from a Certificate Authority (CA). 
• Purchase, Import, and Assign: Use the CSR to get a certificate from a trusted CA. Then, you'll import it and assign it to the necessary Exchange services (e.g., IIS, SMTP). 
• Verify and Communicate: After assigning the new certificate, it’s important to verify the installation using the Microsoft Remote Connectivity Analyzer. Also, make sure to inform your users so they know to expect the security prompt when connecting after the switch. 

For a step-by-step guide, I highly recommend the official Microsoft documentation. It’s super useful for managing certificates on Exchange: Certificate procedures in Exchange Server | Microsoft Learn 

I hope this helps make the certificate switch process go smoothly! If you have any further questions or need additional assistance, please don’t hesitate to reach out.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.