Commands › Exchange Online

Export-ExchangeCertificate

Exchange Online ExchangeOnlineManagement Export-*

Export existing certificates and pending certificate requests (also known as certificate signing requests or CSRs) from Exchange servers.

Quick start script

# Export-ExchangeCertificate — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Export-ExchangeCertificate -Thumbprint <String> | Format-List

# 3. Export for evidence / drift tracking
Export-ExchangeCertificate | Export-Clixml .\ExchangeCertificate-$(Get-Date -Format yyyyMMdd).xml

Syntax — 2 parameter sets

Thumbprint

Export-ExchangeCertificate [-Thumbprint] <String>
 [-Server <ServerIdParameter>]
 [-BinaryEncoded]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-FileName <String>]
 [-Password <SecureString>]
 [-WhatIf]
 [<CommonParameters>]

Identity

Export-ExchangeCertificate [[-Identity] <ExchangeCertificateIdParameter>]
 [-BinaryEncoded]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-FileName <String>]
 [-Password <SecureString>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (9)

Parameter	Type	Required	What it controls
-Thumbprint	String	yes	The Thumbprint parameter specifies the certificate or certificate request that you want to export. You can find the thumbprint value by using the Get-ExchangeCertificate cmdlet.
-Identity	ExchangeCertificateIdParameter		The Identity parameter specifies the certificate or certificate request that you want to export. Valid values are:
-BinaryEncoded	SwitchParameter		The BinaryEncoded switch encodes the exported certificate or certificate request file by using Distinguished Encoding Rules (DER). You don't need to specify a value with this switch.
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DomainController	Fqdn		The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name...
-FileName	String		Note: This parameter was removed from Exchange 2016 and Exchange 2019 by the [2022 H1 Cumulative...
-Password	SecureString		The Password parameter specifies the password for the private key or chain of trust in the exported certificate file. To import the exported certificate file on another server, you need to know the password.
-Server	ServerIdParameter		The Server parameter specifies the Exchange server where you want to run this command. You can use any value that uniquely identifies the server. For example:
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.