Event ID 8007: OWA SSL Certificate Errors - Fix Guide 2025

Log Name:      Application
Source:        MSExchangeFrontEndTransport
Event ID:      8007
Level:         Warning
Description:   Certificate with thumbprint [THUMBPRINT] is expiring soon
               or has already expired.
               Certificate Subject: CN=mail.company.com
               Expiration Date: 1/15/2025 12:00:00 AM
               Services affected: IIS, SMTP

# Or for name mismatch:
Description:   The certificate presented does not match the expected
               hostname. Expected: mail.company.com
               Actual certificate CN: oldserver.company.local

# If you have a valid cert that's not assigned to IIS
# First, find the right certificate
Get-ExchangeCertificate | Where-Object {
    $_.NotAfter -gt (Get-Date) -and
    $_.CertificateDomains -contains "mail.company.com"
} | Select-Object Thumbprint, Subject, NotAfter

# Enable it for IIS (and optionally SMTP)
$thumbprint = "YOUR_CERT_THUMBPRINT"  # Replace with actual

Enable-ExchangeCertificate -Thumbprint $thumbprint -Services IIS,SMTP -Force

# Verify assignment
Get-ExchangeCertificate -Thumbprint $thumbprint | Select-Object Subject, Services

# Restart IIS
iisreset /noforce

Import-Module WebAdministration

# Get the correct certificate thumbprint from Exchange
$exchangeCert = Get-ExchangeCertificate | Where-Object {
    $_.Services -match "IIS" -and $_.NotAfter -gt (Get-Date)
}
$thumbprint = $exchangeCert.Thumbprint

# Update IIS binding
$binding = Get-WebBinding -Name "Default Web Site" -Protocol https

# Remove old binding
Remove-WebBinding -Name "Default Web Site" -Protocol https

# Add new binding with correct certificate
New-WebBinding -Name "Default Web Site" -Protocol https -Port 443

$binding = Get-WebBinding -Name "Default Web Site" -Protocol https
$binding.AddSslCertificate($thumbprint, "My")

Write-Host "Certificate binding updated"

# Restart IIS
iisreset /noforce

# If you have a new certificate file (.pfx)
$certPath = "C:\Certs\newcert.pfx"
$certPassword = ConvertTo-SecureString "YourPassword" -AsPlainText -Force

# Import the certificate
$newCert = Import-ExchangeCertificate -FileName $certPath -Password $certPassword

Write-Host "Imported certificate: $($newCert.Thumbprint)"

# Enable for Exchange services
Enable-ExchangeCertificate -Thumbprint $newCert.Thumbprint -Services IIS,SMTP,POP,IMAP -Force

# Verify
Get-ExchangeCertificate -Thumbprint $newCert.Thumbprint | Format-List Subject, Services, NotAfter

# Restart IIS
iisreset /noforce

# Create certificate request with all needed names
$domains = @(
    "mail.company.com",
    "autodiscover.company.com",
    "exchange2019.company.local"  # Server FQDN
)

# Generate the request
$request = New-ExchangeCertificate -GenerateRequest -SubjectName "CN=mail.company.com, O=Company Name, L=City, S=State, C=US" -DomainName $domains -PrivateKeyExportable $true -KeySize 2048 -FriendlyName "Exchange Certificate $(Get-Date -Format 'yyyy')"-Format 'yyyy')"

# Save CSR to file
$request | Out-File "C:\Certs\ExchangeCSR.txt"

Write-Host "CSR saved to C:\Certs\ExchangeCSR.txt"
Write-Host "Submit this to your Certificate Authority (CA)`n"
Write-Host "For public CA: DigiCert, GoDaddy, Let's Encrypt, etc."
Write-Host "For internal CA: Submit via your Windows CA web enrollment"

# After CA signs the request, complete it
$certFile = "C:\Certs\signed-certificate.cer"

# Import the signed certificate
$importedCert = Import-ExchangeCertificate -FileName $certFile

Write-Host "Certificate imported with thumbprint: $($importedCert.Thumbprint)"

# Enable for all services
Enable-ExchangeCertificate -Thumbprint $importedCert.Thumbprint -Services IIS,SMTP,POP,IMAP -Force

# If using multiple Exchange servers, export and import to others
# Export from first server:
# $pass = ConvertTo-SecureString "ExportPassword" -AsPlainText -Force-SecureString "ExportPassword" -AsPlainText -Force
# Export-ExchangeCertificate -Thumbprint $importedCert.Thumbprint -FileName "C:\Certs\export.pfx" -BinaryEncoded -Password $pass-Thumbprint $importedCert.Thumbprint -FileName "C:\Certs\export.pfx" -BinaryEncoded -Password $pass

# Restart IIS
iisreset /noforce

# If your CA provided intermediate certificates, install them
$intermediateCert = "C:\Certs\intermediate.cer"

# Import to Intermediate CA store
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$cert.Import($intermediateCert)

$store = New-Object System.Security.Cryptography.X509Certificates.X509Store(
    "CA",  # Intermediate Certification Authorities
    "LocalMachine"
)
$store.Open("ReadWrite")
$store.Add($cert)
$store.Close()

Write-Host "Intermediate certificate installed"

# Verify chain now validates
$iisCert = Get-ExchangeCertificate | Where-Object {$_.Services -match "IIS"}
$certObj = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($iisCert.Certificate)
$chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
$chain.Build($certObj)

Write-Host "Chain status: $($chain.ChainStatus.Status)"

# Step 1: Document current self-signed cert-signed cert
$selfSigned = Get-ExchangeCertificate | Where-Object {
    $_.IsSelfSigned -eq $true -and $_.Services -match "IIS"
}
Write-Host "Current self-signed cert: $($selfSigned.Subject)"$selfSigned.Subject)"

# Step 2: Generate CSR (see Scenario 1 above)1 above)
# Step 3: Get signed by public CA (DigiCert, GoDaddy, Let's Encrypt, etc.)'s Encrypt, etc.)
# Step 4: Import and enable new certificate

# After new cert is working, remove old self-signed
# (Wait a few days to ensure everything works first)
# Remove-ExchangeCertificate -Thumbprint $selfSigned.Thumbprint -Confirm:$true

Write-Host @"
Public CA Recommendations:
- DigiCert: Best support, higher cost
- GoDaddy: Budget-friendly, good support
- Let'# After new cert is working, remove old self-signed
# (Wait a few days to ensure everything works first)
# Remove-ExchangeCertificate -Thumbprint $selfSigned.Thumbprint -Confirm:$true-Thumbprint $selfSigned.Thumbprint -Confirm:$true

Write-Host @"
Public CA Recommendations:
- DigiCert: Best support, higher cost
- GoDaddy: Budget-friendly, good support
- Let's Encrypt: Free, but requires renewal automation
- Comodo/Sectigo: Good balance of cost/features
"

# Export certificate from primary server
$cert = Get-ExchangeCertificate | Where-Object {$_.Services -match "IIS" -and $_.NotAfter -gt (Get-Date)}
$exportPath = "\\FileServer\Certs\exchange-cert.pfx"
$password = ConvertTo-SecureString "StrongPassword123!" -AsPlainText -Force

Export-ExchangeCertificate -Thumbprint $cert.Thumbprint -FileName $exportPath -BinaryEncoded -Password $password

Write-Host "Certificate exported to $exportPath"

# On each additional Exchange server, run:
$servers = @("EX02", "EX03")  # Other Exchange servers

foreach ($server in $servers) {
    Write-Host "Installing on $server..."

    Invoke-Command -ComputerName $server -ScriptBlock {
        param($pfxPath, $pfxPassword)

        Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn

        # Import certificate
        $imported = Import-ExchangeCertificate -FileName $pfxPath -Password $pfxPassword

        # Enable for services
        Enable-ExchangeCertificate -Thumbprint $imported.Thumbprint -Services IIS,SMTP -Force

        # Restart IIS
        iisreset /noforce

    } -ArgumentList $exportPath, $password
}

Write-Host "Certificate deployed to all servers"

# 1. Check certificate is assigned
Get-ExchangeCertificate | Where-Object {$_.Services -match "IIS"} |
  Select-Object Subject, NotAfter, Status, @{N='DaysRemaining';E={($_.NotAfter - (Get-Date)).Days}}

# 2. Test OWA URL with certificate validation
$url = "https://mail.company.com/owa/"
try {
    # This will fail if cert has issues
    $response = Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 30
    Write-Host "OWA accessible with valid certificate" -ForegroundColor Green
} catch {
    if ($_.Exception.Message -like "*certificate*") {
        Write-Host "Certificate error: $($_.Exception.Message)" -ForegroundColor Red
    } else {
        Write-Host "Other error: $($_.Exception.Message)" -ForegroundColor Yellow
    }
}

# 3. Full Exchange connectivity test
Test-OwaConnectivity -URL $url | Select-Object Scenario, Result, Latency

# 4. Check certificate from external (if accessible)
# Use: https://www.ssllabs.com/ssltest/

# 5. Verify IIS binding matches
Import-Module WebAdministration
$binding = Get-WebBinding -Name "Default Web Site" -Protocol https
$exchangeCert = Get-ExchangeCertificate | Where-Object {$_.Services -match "IIS"}

if ($binding.certificateHash -eq $exchangeCert.Thumbprint) {
    Write-Host "IIS binding matches Exchange certificate: OK" -ForegroundColor Green
} else {
    Write-Host "IIS binding mismatch!" -ForegroundColor Red
}

# Schedule this weekly
$warningDays = 30
$criticalDays = 14

$certs = Get-ExchangeCertificate | Where-Object {$_.Services -ne "None"}

foreach ($cert in $certs) {
    $daysRemaining = ($cert.NotAfter - (Get-Date)).Days

    if ($daysRemaining -lt $criticalDays) {
        $priority = "CRITICAL"
        $color = "Red"
    } elseif ($daysRemaining -lt $warningDays) {
        $priority = "WARNING"
        $color = "Yellow"
    } else {
        continue  # Skip healthy certs
    }

    $body = @"
Certificate Expiration $priority

Subject: $($cert.Subject)
Expires: $($cert.NotAfter)
Days Remaining: $daysRemaining
Services: $($cert.Services)
Server: $env:COMPUTERNAME

Action Required: Renew certificate before expiration.
"$cert.Subject)
Expires: $($cert.NotAfter)
Days Remaining: $daysRemaining
Services: $($cert.Services)
Server: $env:COMPUTERNAME

Action Required: Renew certificate before expiration.
"@

    Send-MailMessage -To "admin@company.com" -From "monitor@company.com" -Subject "[$priority] Exchange Certificate Expiring" -Body $body -SmtpServer localhost

    Write-Host "Alert sent for $($cert.Subject) - $daysRemaining days remaining"$daysRemaining days remaining" -ForegroundColor $color
}