Exchange 2016: Renew Let's Encrypt certificate

In a previous article I have already described how the free Let's Encrypt certificates can be requested using PowerShell and assigned to the Exchange services.

I am currently working on automating the entire process from requesting the Let's Encrypt certificate to automatic renewal with PowerShell. The goal is a fire-and-forget script for the Exchange certificates, let's see if it works.

In the article linked at the beginning, requesting a certificate via Let's Encrypt already worked. However, the certificates are only valid for 3 months and must therefore be replaced regularly.

I have now tested renewing the certificate using the following script:

Import modules ACMESharp
Import-Modules Webadministration
Add-PSSnapin *exchange*

$PFXPassword = Get-Random -Minimum 1000000 -Maximum 9999999

$CurrentCertThumbprint = (Get-ChildItem -Path IIS:SSLBindings | where {$_.port -match "443" -and $_.IPAddress -match "0.0.0.0" } | select Thumbprint).Thumbprint
$ExchangeCertificate = Get-ExchangeCertificate -Thumbprint $CurrentCertThumbprint
$ExchangeSANs = ($ExchangeCertificate.CertificateDomains).Address
$ExchangeSubject = $ExchangeCertificate.Subject.Replace("CN=","")

if ($ExchangeSANs -notcontains $ExchangeSubject) {$ExchangeSANs += $ExchangeSubject}

$ExchangeSANs

$ExchangeSANID = 1
foreach ($ExchangeSAN in $ExchangeSANs)
 {
  $CurrentDate = get-date -format ddMMyyyy
  $ACMEAlias = "Cert" + "$CurrentDate" + "-" + "$ExchangeSANID"
  $ExchangeSANID++
  
  write-host "New Identifier:"
  New-ACMEIdentifier -Dns $ExchangeSAN -Alias $ACMEAlias
  write-host "Complete Challenge:"
  Complete-ACMEChallenge $ACMEAlias -ChallengeType http-01 -Handler iis -HandlerParameters @{ WebSiteRef = 'Default Web Site' }
  [Array]$ACMEAliasArray += $ACMEAlias
  if ($ExchangeSAN -match $ExchangeSubject) {$ExchangeSubjectAlias = $ACMEAlias}
 }

foreach ($ACMEAlias in $ACMEAliasArray)
 {
  write-host "Submit Challange:"
  Submit-ACMEChallenge $ACMEAlias -ChallengeType http-01
 }

sleep -seconds 30

foreach ($ACMEAlias in $ACMEAliasArray)
 {
  write-host "Update:"
  Update-ACMEIdentifier $ACMEAlias
 }

$SANAlias = "SAN" + "$CurrentDate"
New-ACMECertificate $ExchangeSubjectAlias -Generate -AlternativeIdentifierRefs $ACMEAliasArray -Alias $SANAlias
Submit-ACMECertificate $SANAlias

sleep -seconds 30

Update-ACMECertificate $SANAlias

$CertPath = "$env:temp" + "\" + "$SANAlias" + ".pfx"
Get-ACMECertificate $SANAlias -ExportPkcs12 $CertPath -CertificatePassword $PFXPassword

$ImportPassword = ConvertTo-SecureString -String $PFXPassword -Force -AsPlainText
Import-ExchangeCertificate -FileName $CertPath -FriendlyName $ExchangeSubject -Password $ImportPassword -PrivateKeyExportable:$true | Enable-ExchangeCertificate -Services "SMTP, IMAP, POP, IIS" -force

This script was only used for testing, it does not yet contain any error handling, documentation or similar. The good news: The replacement of the existing Let's Encrypt certificate worked. Here are two screenshots of the script:

I ran the PowerShell as administrator and used the test environment with the original certificate to test the renewal process.

So two important building blocks for the fire-and-forget script are already basically working. But it will still take some time before the tool is ready...