How to generate a CSR for Microsoft Exchange 2016
The instructions below walk you through generating a CSR on Microsoft Exchange 2016. For more on CSRs and why your private key matters, see our Certificate Signing Request overview. If you have already generated the CSR and received your trusted SSL certificate, see our Exchange 2016 SSL installation instructions and skip the steps below.
1. Log in to the Exchange Admin Center (EAC)
In a browser, go to your server's URL, that is, https://localhost/ecp
On the EAC sign-in page, enter your domain or username and your password, and log in.
2. Go to "Certificates"
In the EAC, in the left sidebar, click Servers, then in the menu at the top of the page click Certificates.
On the Certificates page, use the Select server menu to choose your Exchange 2016 server, then click the + symbol.
3. Create a new request
In the new Exchange certificate wizard, select Create a request for a certificate from a certification authority and click Next.
4. Enter a friendly name
Type a friendly name for this certificate. The friendly name is what tells this certificate apart from others with the same domain name, and it is not included in the certificate file itself.
We suggest putting the date and the issuer in the friendly name, so you can identify it later at a glance.
5. Say whether the certificate is a wildcard
If you are not creating a CSR for a wildcard SSL certificate, click Next.
If you are creating a wildcard SSL CSR, tick Request a wildcard certificate.
The root domain has to be in wildcard format, for example *.domain.com
6. Choose which server to save the request on
Store certificate request on this server: click Browse and select the server where the certificate request should be stored. Click Next.
7. Specify the domains
Select the domains to include in the SSL certificate:
If you are creating a wildcard SSL CSR, skip this step and click Next.
Select the domains you want included in your SSL certificate.
IMPORTANT: adding extra domains to your CSR does not put them in the certificate on its own. You also have to list them on your SSL order form, during the online generation step.
Click Next and the wizard fills in a list of suggested domains. You do not have to edit the list on this page; you can edit it on the next one.
On the next page you can add, edit, remove or select the domains to be included in the SSL certificate. Then click Next.
8. Enter the CSR details
Give the details of your organisation:
- Organisation name: your company's registered name. If there is no company involved, put your domain, or None.
- Department name: your department, if you have one.
- City/locality: the city or town you are in.
- State/province: the state, province or region you are in. Do not abbreviate.
- Country: choose your country from the drop-down.
9. Save the CSR
Save the certificate request to the following file: enter a UNC path to save your CSR to. You need to be able to reach that location to retrieve it.
Click Finish to save the CSR to the UNC path you gave.
10. Generate the order
Open the CSR file in a plain text editor such as Notepad. Copy the whole block of text, including the -----BEGIN NEW CERTIFICATE REQUEST----- header and the -----END NEW CERTIFICATE REQUEST----- footer.
Go back to the generation form on our website, paste the whole CSR into the empty text box and carry on through the generation process.
Once you generate your CSR, your order enters validation with the issuing certificate authority, which will ask whoever requested the certificate to complete some form of validation depending on the certificate purchased. For the different levels of validation and how to satisfy the industry requirements, see our validation articles.
After validation is complete and the certificate authority has issued your trusted SSL certificate, carry on with our Microsoft Exchange 2016 SSL installation instructions.
