Commands › Exchange Online

Get-ExchangeCertificate

Exchange Online ExchangeOnlineManagement Get-*

View Exchange certificates that are installed on Exchange servers. This cmdlet returns Exchange self-signed certificates, certificates that were issued by a certification authority and pending certificate requests (also known as certificate signing requests or CSRs).

Quick start script

# Get-ExchangeCertificate — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Get-ExchangeCertificate | Format-List

# 3. Export for evidence / drift tracking
Get-ExchangeCertificate | Export-Clixml .\ExchangeCertificate-$(Get-Date -Format yyyyMMdd).xml

Syntax — 3 parameter sets

Identity

Get-ExchangeCertificate [[-Identity] <ExchangeCertificateIdParameter>]
 [-DomainController <Fqdn>]
 [-DomainName <MultiValuedProperty>]
 [<CommonParameters>]

Instance

Get-ExchangeCertificate [-Instance <X509Certificate2>]
 [-DomainController <Fqdn>]
 [-DomainName <MultiValuedProperty>]
 [-Server <ServerIdParameter>]
 [<CommonParameters>]

Thumbprint

Get-ExchangeCertificate [[-Thumbprint] <String>]
 [-DomainController <Fqdn>]
 [-DomainName <MultiValuedProperty>]
 [-Server <ServerIdParameter>]
 [<CommonParameters>]

Parameters (6)

Parameter	Type	What it controls
-Thumbprint	String	The Thumbprint parameter specifies the thumbprint value of the certificate that you want to view.
-Identity	ExchangeCertificateIdParameter	The Identity parameter specifies the certificate that you want to view. Valid values are:
-DomainController	Fqdn	The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name...
-DomainName	MultiValuedProperty	The DomainName parameter filters the results by the fully qualified domain name (FQDN) or server name values in the Subject Name or the Subject Alternative Name fields. You can specify multiple values separated by commas.
-Instance	X509Certificate2	This parameter is deprecated and no longer used.
-Server	ServerIdParameter	The Server parameter specifies the Exchange server where you want to run this command. You can use any value that uniquely identifies the server. For example:

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.