Commands › Exchange Online

New-ExchangeCertificate

Exchange Online ExchangeOnlineManagement New-*

Create and renew self-signed certificates, and to create certificate requests (also known as certificate signing requests or CSRs) for new certificates and certificate renewals from a certification authority (CA).

Quick start script

# New-ExchangeCertificate — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-ExchangeCertificate
$before | Format-List

# 3. Make the change (dry run first)
New-ExchangeCertificate  -WhatIf
New-ExchangeCertificate

# 4. Verify and diff
$after = Get-ExchangeCertificate
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax — 2 parameter sets

Request

New-ExchangeCertificate [-BinaryEncoded] [-GenerateRequest] [-RequestFile <String>]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-DomainName <MultiValuedProperty>]
 [-Force]
 [-FriendlyName <String>]
 [-IncludeAcceptedDomains]
 [-IncludeAutoDiscover]
 [-IncludeServerFQDN]
 [-IncludeServerNetBIOSName]
 [-Instance <X509Certificate2>]
 [-KeySize <Int32>]
 [-PrivateKeyExportable <Boolean>]
 [-Server <ServerIdParameter>]
 [-SubjectKeyIdentifier <String>]
 [-SubjectName <X500DistinguishedName>]
 [-WhatIf]
 [<CommonParameters>]

Certificate

New-ExchangeCertificate [-Services <AllowedServices>]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-DomainName <MultiValuedProperty>]
 [-Force]
 [-FriendlyName <String>]
 [-IncludeAcceptedDomains]
 [-IncludeAutoDiscover]
 [-IncludeServerFQDN]
 [-IncludeServerNetBIOSName]
 [-Instance <X509Certificate2>]
 [-KeySize <Int32>]
 [-PrivateKeyExportable <Boolean>]
 [-Server <ServerIdParameter>]
 [-SubjectKeyIdentifier <String>]
 [-SubjectName <X500DistinguishedName>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (20)

Parameter	Type	What it controls
-BinaryEncoded	SwitchParameter	The BinaryEncoded switch specifies whether to encode the new certificate request by using Distinguished Encoding Rules (DER). You don't need to specify a value with this switch.
-Confirm	SwitchParameter	The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DomainController	Fqdn	The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name...
-DomainName	MultiValuedProperty	The DomainName parameter specifies one or more FQDNs or server names for theSubject Alternative Name field (also known as the Subject Alt Name or SAN field) of the certificate request or self-signed certificate.
-Force	SwitchParameter	The Force switch hides warning or confirmation messages. You don't need to specify a value with this switch.
-FriendlyName	String	The FriendlyName parameter specifies a friendly name for the certificate request or self-signed certificate. The value must be less than 64 characters.
-GenerateRequest	SwitchParameter	The GenerateRequest switch specifies that you're creating a certificate request for a certification authority (CA). You don't need to specify a value with this switch.
-IncludeAcceptedDomains	SwitchParameter	The IncludeAcceptedDomains switch specifies that all accepted domains in the Exchange organization are included in the Subject Alternative Name field of the certificate request or self-signed certificate. You don't...
-IncludeAutoDiscover	SwitchParameter	The IncludeAutoDiscover switch specifies whether to add a Subject Alternative Namevalue with the prefix autodiscover for each accepted domain in the Exchange organization. You don't need to specify a value with this switch.
-IncludeServerFQDN	SwitchParameter	The IncludeServerFQDN switch specifies that the FQDN of the Exchange server is included in the Subject Alternative Name field of the new certificate request or self-signed certificate. You don't need to specify a...
-IncludeServerNetBIOSName	SwitchParameter	The IncludeServerNetBIOSName switch specifies that the NetBIOS name of the Exchange server is included in the Subject Alternative Name field of the new certificate request or self-signed certificate. You don't need...
-Instance	X509Certificate2	This parameter is deprecated and no longer used.
-KeySize	Int32	The KeySize parameter specifies the size (in bits) of the RSA public key that's associated with the new certificate request or self-signed certificate. Valid values are:
-PrivateKeyExportable	Boolean	The PrivateKeyExportable parameter specifies whether the certificate has an exportable private key, and controls whether you can export the certificate from the server (and import the certificate on other servers)....
-RequestFile	String	Note: This parameter was removed from Exchange 2016 and Exchange 2019 by the [2022 H1 Cumulative...
-Server	ServerIdParameter	The Server parameter specifies the Exchange server where you want to run this command. You can use any value that uniquely identifies the server. For example:
-Services	AllowedServices	The Services parameter specifies the Exchange services that the new self-signed certificate is enabled for. Valid values are:
-SubjectKeyIdentifier	String	The SubjectKeyIdentifier parameter specifies the unique subject key identifier for a newself-signed certificate. For example, run the command: $ski = [System.Guid]::NewGuid().ToString("N"), and use the value $ski for...
-SubjectName	X500DistinguishedName	The SubjectName parameter specifies the Subject field of the certificate request or self-signed certificate.
-WhatIf	SwitchParameter	The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.