How to Transfer Exchange Certificates from Exchange 2016 to 2019
Question details
Administrators need to transfer existing PFX and self-signed certificates from Exchange Server 2016 to a new Exchange Server 2019 environment during migration.
- Product
- Microsoft Exchange Server
- Device & OS
- not provided
- Scenario
- Migrating services and SSL configurations from Exchange Server 2016 to Exchange Server 2019.
- Observed behavior
- The user needs to know the correct procedure for transferring custom PFX certificates, ensuring the private key is included, and handling default self-signed certificates.
Ensure you have the valid PFX file exported from your Exchange 2016 server along with its correct password, and verify that it contains the private key before attempting the import.
Import the PFX Certificate to Exchange 2019
Use this method to import your custom SSL certificate to the new server using the Exchange Admin Center (EAC).
If you already possess the exported PFX file and its password, you can directly import it to your new Exchange 2019 server. The PFX must include the private key for the certificate to function correctly on the new server.
Ensure the PFX file exported from your Exchange 2016 server is accessible from a network share or directly copied to the new Exchange 2019 server.
Open the Exchange Admin Center (EAC) on Exchange 2019, navigate to Servers > Certificates, and click the 'Import Exchange certificate' icon (the three dots followed by Import).
Provide the UNC path to the PFX file, enter the associated password, and select the Exchange 2019 server to apply the imported certificate to.
Once the certificate is imported, select it in the EAC list, click the Edit (pencil) icon, go to the Services tab, and assign the necessary Exchange services (such as IIS, SMTP, IMAP, and POP).
Handling Self-Signed and Custom Federation Certificates
Understand how Exchange handles default self-signed certificates and how to manually migrate custom configurations.
Document Your Server Migration Seamlessly with WPS Office
Managing an Exchange Server migration requires extensive planning, documentation, and reporting. While you handle backend IT operations, WPS Office provides a robust, free, and lightweight alternative to Microsoft Office for managing all your project documentation needs.
Frequently Asked Questions
Do I need to migrate the default self-signed certificates from Exchange 2016?
No, Exchange Server automatically creates its standard self-signed certificates during the installation of Exchange 2019. You only need to transfer custom SSL certificates or specialized federation configurations.
What if the private key was marked as non-exportable on the old server?
If you already have a previously exported PFX file that contains the private key, you can still use it to import the certificate to the new server. The export restriction on the old server does not affect the existing PFX file.
How do I verify the certificate assignments after migration?
After importing the certificates, you can verify the assignments by checking the Exchange Admin Center under Servers > Certificates, or by running the Get-ExchangeCertificate cmdlet in the Exchange Management Shell to ensure the correct services (like IIS and SMTP) are bound.
