The Microsoft Exchange Server backend services SSL certificate occassionally expires and needs to be renewed. This certificate is not signed by a third party trusted signing authority and is generated locally.
The renewal process is pretty simple. Launch the Exchange PowerShell with administrative rights
Once the PS session has loaded, we need to list all the certificates with the Subject containing CN=Microsoft Exchange.
Get-ExchangeCertificate | Where-Object {$_.Subject -eq "CN=Microsoft Exchange"}
Locate the thumbprint and use it in the next command:
Get-ExchangeCertificate -Thumbprint "<Old_Thumbprint>" | New-ExchangeCertificate -Force -PrivateKeyExportable $true
Rerun the first command and now you should see an additional certificate listed
Now return to IIS and edit the bindings of the Exchange BackEnd site
In the SSL certificate dropdown, the currently selected certificate will still be the old certificate.
Select the other certificate from the list with the same name: Microsoft Exchange
Once selected, click View to confirm this is the newly generated certificate by checking the validity period
Click OK and restart the BackEnd site