Instale GRATIS el certificado Let's Encrypt en Exchange Server

¿Cómo instalar el certificado Let's Encrypt GRATIS en Exchange Server? Después de configurar el DNS interno y externo, nos gusta instalar un certificado en Exchange Server. ¿Qué es Let's Encrypt y por qué es gratuito? Lea más en este artículo sobre cómo configurar el certificado Let's Encrypt en Exchange Server.

¿Qué es Let's Encrypt?

Let's Encrypt es una forma gratuita de proteger su servidor web mediante HTTPS con un certificado SSL. Garantiza una transferencia de datos cifrada segura y una conexión entre el servidor y el cliente. Let's Encrypt no cobra ninguna tarifa por los certificados. Let's Encrypt es una organización sin fines de lucro y su misión es crear una Web más segura y que respete la privacidad. Lo hacen promoviendo la adopción generalizada de HTTPS. Los servicios son gratuitos y fáciles de usar para que todos puedan implementar HTTPS.

Certificado de Exchange Server no confiable

Al instalar un nuevo servidor Exchange, la conexión del cliente no se instala de forma segura. Eso es por defecto. Iniciaremos sesión en Outlook Web Access (OWA) para ver cómo se muestra.

En Firefox, muestra una Advertencia: Riesgo potencial de seguridad en el futuro. Haga clic en Avanzado... y continúe para ver la página de inicio de sesión de OWA.

El servidor Exchange OWA está funcionando, pero no es seguro. El icono del candado muestra una advertencia. Si pulsamos el candado de la barra de direcciones podremos ver que la conexión no es segura.

Lo mismo ocurre con todos los demás navegadores. Por ejemplo, Internet Explorer muestra una barra de direcciones roja. Al hacer clic en el certificado en la barra de herramientas, se muestra que el certificado es una dirección que no coincide. La conexión del servidor Exchange no es segura.

Aprendimos sobre Let's Encrypt y vimos que la conexión al servidor Exchange no es segura. En la siguiente parte, prepararemos la aplicación para configurar el certificado. Después de eso, solicitaremos un certificado Let's Encrypt gratuito.

Prepare el cliente Let's Encrypt Win-ACME

Existe una lista de clientes ACME ofrecidos por terceros para su uso. Usaremos Windows ACME Simple (WACS). Un cliente ACME sencillo para Windows, para usar con Let's Encrypt. Renovará automáticamente sus certificados, por lo que después de instalarlo y configurarlo, tendrá un servidor web continuamente protegido.

Descargue Win-ACME desde GitHub o el sitio web oficial. En el momento de escribir este artículo, el archivo es win-acme.v2.1.22.1260.x64.pluggable. Cree una carpeta llamada Lets Encrypt en C:\Program Files. Extraiga los archivos en el formato .zip a la carpeta C:\Program Files\Lets Encrypt.

Puede utilizar Win-ACME desde el menú interactivo o en modo desatendido (línea de comando). Con la línea de comando, no es necesario saltar por los menús. Ambos funcionarán y es bueno aprender de ambos modos.

Ciframos la clave privada del certificado

Es mejor exportar el certificado después de haberlo emitido y descargado desde Let's Encrypt. Significa que debe importar la clave privada del certificado para exportarlo. Hay dos formas de hacer esto.

Importación automática de clave privada de certificado

Ajuste settings_default.json antes de solicitar un certificado de Let's Encrypt. Esto importará automáticamente la clave privada del certificado al certificado:

Inicie el Explorador de archivos
Vaya a la ruta C:\Program Files\Lets Encrypt
Abra settings_default.json con el Bloc de notas
Establezca PrivateKeyExportable en verdadero
Guarde el archivo

Nota: El archivo settings_default.json se copiará con su configuración en settings.json después de iniciar Win-ACME. Si ya inició Win-ACME, verá settings.json en la carpeta. Edite el valor en settings.json.

Importación manual de clave privada de certificado

Obtenga la clave privada después de la solicitud de certificado de Let's Encrypt. Ingresará la clave privada del certificado y la importará al certificado. Más información sobre esto en el artículo Exportar certificado Let's Encrypt en Windows Server.

Instale el certificado Let's Encrypt en Exchange Server

Después de descargar y extraer los archivos, configuraremos el certificado Let's Encrypt. Vamos a mostrar tanto el menú interactivo como la línea de comando en los siguientes pasos.

Instale el certificado Let's Encrypt usando el menú interactivo

Haga clic derecho en la aplicación wacs. Haga clic en ejecutar como administrador para iniciar la aplicación.

Aparecerá la ventana del cliente Win-ACME. Escriba M para crear un certificado de renovación (opción completa) y presione Entrar.

 A simple Windows ACMEv2 client (WACS)
 Software version 2.1.22.1260 (release, pluggable, standalone, 64-bit)
 Connecting to https://acme-v02.api.letsencrypt.org/...
 Scheduled task not configured yet
 Please report issues at https://github.com/win-acme/win-acme

 N: Create certificate (default settings)
 M: Create certificate (full options)
 R: Run renewals (0 currently due)
 A: Manage renewals (0 total)
 O: More options...
 Q: Quit

 Please choose from the menu: M

Escriba 2 para la entrada manual y presione Entrar.

 Running in mode: Interactive, Advanced

 Please specify how the list of domain names that will be included in the
 certificate should be determined. If you choose for one of the "all bindings"
 options, the list will automatically be updated for future renewals to
 reflect the bindings at that time.

 1: Read bindings from IIS
 2: Manual input
 3: CSR created by another program
 C: Abort

 How shall we determine the domain(s) to include in the certificate?: 2

Introduzca una lista de nombres de host separados por comas. Eche un vistazo a sus nombres de host de Exchange y complételos. ¿Ha configurado correctamente los nombres de host de Exchange Server? No debe haber nombres internos, por ejemplo, EX01-2016.

Eche un vistazo al artículo Diseño y planificación del espacio de nombres de Exchange. Recomiendo mantener el mismo espacio de nombres para el DNS interno y el DNS externo.

Agregue el nombre de host de descarga al host y, una vez que el certificado Let's Encrypt se descargue y se vincule al servidor Exchange, lea el artículo Configurar dominios de descarga para abordar la vulnerabilidad CVE-2021-1730.

En mi ejemplo, usaré el host:

correo.exoip.com
descubrimiento automático.exoip.com
descargar.mail.exoip.com

Después de eso, presione Entrar.

 Description:        A host name to get a certificate for. This may be a
                     comma-separated list.

 Host: mail.exoip.com,autodiscover.exoip.com,download.mail.exoip.com

No ingresaremos nada para el nombre descriptivo sugerido. Pulsa Entrar para continuar.

 Source generated using plugin Manual: mail.exoip.com and 1 alternatives

 Friendly name '[Manual] mail.exoip.com'. <Enter> to accept or type desired name: <Enter>

El cliente ACME de Let's Encrypt se conectará con Let's Encrypt en el puerto 80 a través del firewall para solicitar un certificado. Si no tiene el puerto 80 habilitado, hágalo antes de continuar. Obtenga más información sobre los puertos de red para clientes y el flujo de correo en Exchange.

No tenemos que habilitar el puerto 80 en Exchange Server. Podemos usar el puerto 443, que es la opción 9 - TLS-ALPN-01. Para manejar el desafío correctamente, no podemos pasar por la pila HTTP. Necesitamos control directo (acceso exclusivo) sobre el puerto 443, lo que significa que IIS debe estar cerrado para que funcione.

No desea cerrar IIS cada vez que solicite o actualice el certificado de Exchange. Es por eso que habilitamos el puerto 80 en el firewall y elegimos la opción 2.

 The ACME server will need to verify that you are the owner of the domain
 names that you are requesting the certificate for. This happens both during
 initial setup *and* for every future renewal. There are two main methods of
 doing so: answering specific http requests (http-01) or create specific dns
 records (dns-01). For wildcard domains the latter is the only option. Various
 additional plugins are available from https://github.com/win-acme/win-acme/.

 1: [http-01] Save verification files on (network) path
 2: [http-01] Serve verification files from memory
 3: [http-01] Upload verification files via FTP(S)
 4: [http-01] Upload verification files via SSH-FTP
 5: [http-01] Upload verification files via WebDav
 6: [dns-01] Create verification records manually (auto-renew not possible)
 7: [dns-01] Create verification records with acme-dns (https://github.com/joohoi/acme-dns)
 8: [dns-01] Create verification records with your own script
 9: [tls-alpn-01] Answer TLS verification request from win-acme
 C: Abort

 How would you like prove ownership for the domain(s)?: 2

Escriba 2 para la clave RSA y presione Entrar.

 After ownership of the domain(s) has been proven, we will create a
 Certificate Signing Request (CSR) to obtain the actual certificate. The CSR
 determines properties of the certificate like which (type of) key to use. If
 you are not sure what to pick here, RSA is the safe default.

 1: Elliptic Curve key
 2: RSA key
 C: Abort

 What kind of private key should be used for the certificate?: 2

Elija la opción 4 para almacenar el certificado en el almacén de certificados de Windows y presione Entrar.

 When we have the certificate, you can store in one or more ways to make it
 accessible to your applications. The Windows Certificate Store is the default
 location for IIS (unless you are managing a cluster of them).

 1: IIS Central Certificate Store (.pfx per host)
 2: PEM encoded files (Apache, nginx, etc.)
 3: PFX archive
 4: Windows Certificate Store
 5: No (additional) store steps

 How would you like to store the certificate?: 4

Escribe 2 como nos gusta para almacenarlo en la tienda de informática general y pulsa Enter.

 1: [WebHosting] - Dedicated store for IIS
 2: [My] - General computer store (for Exchange/RDS)
 3: [Default] - Use global default, currently WebHosting

 Choose store to use, or type the name of another unlisted store: 2

Escribe 5 ya que no necesitamos almacenarlo de otra manera y presiona Enter.

 1: IIS Central Certificate Store (.pfx per host)
 2: PEM encoded files (Apache, nginx, etc.)
 3: PFX archive
 4: Windows Certificate Store
 5: No (additional) store steps

 Would you like to store it in another way too?: 5

Seleccione 1 para crear o actualizar enlaces https en IIS y presione Entrar.

 With the certificate saved to the store(s) of your choice, you may choose one
 or more steps to update your applications, e.g. to configure the new
 thumbprint, or to update bindings.

 1: Create or update bindings in IIS
 2: Start external script or program
 3: No (additional) installation steps

 Which installation step should run first?: 1

Escriba 1 para Sitio web predeterminado y presione Entrar.

 1: Default Web Site
 2: Exchange Back End

 Choose site to create new bindings: 1

Escriba 2 para iniciar un script o programa externo y presione Intro.

 1: Create or update bindings in IIS
 2: Start external script or program
 3: No (additional) installation steps

 Add another installation step?: 2

Agregue la ruta del script de PowerShell ./Scripts/ImportExchange.ps1 y presione Entrar. La descarga de ACME incluye el script. Eche un vistazo a la carpeta de scripts ACME.

 Description:        Path to script file to run after retrieving the
                     certificate. This may be any executable file or a
                     Powershell (.ps1) script.

 File: ./Scripts/ImportExchange.ps1

Agregue los siguientes parámetros, incluidos los servicios IIS, SMTP e IMAP. Pulsa Entrar.

 {CertCommonName}:   Common name (primary domain name)
 {CachePassword}:    .pfx password
 {CacheFile}:        .pfx full path
 {CertFriendlyName}: Certificate friendly name
 {CertThumbprint}:   Certificate thumbprint
 {StoreType}:        Type of store (e.g. CentralSsl, CertificateStore,
                     PemFiles, ...)
 {StorePath}:        Path to the store
 {RenewalId}:        Renewal identifier
 {OldCertCommonName}: Common name (primary domain name) of the previously
                      issued certificate
 {OldCertFriendlyName}: Friendly name of the previously issued certificate
 {OldCertThumbprint}: Thumbprint of the previously issued certificate

 Description:        Parameters for the script to run after retrieving the
                     certificate. Refer to
                     https://win-acme.com/reference/plugins/installation/script
                     for further instructions.

 Parameters: '{CertThumbprint}' 'IIS,SMTP,IMAP' 1 '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'

No necesitamos agregar otro paso de instalación. Presione 3 y presione Entrar.

 1: Create or update bindings in IIS
 2: Start external script or program
 3: No (additional) installation steps

 Add another installation step?: 3

Presione n para no abrir los términos de servicio y presione Entrar. Siempre podemos consultar los términos de servicio abriendo el archivo PDF en el Explorador de archivos.

Terms of service:   C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\LE-SA-v1.2-November-15-2017.pdf

 Open in default application? (y/n*) n

Presione y para aceptar los términos y presione Enter.

Do you agree with the terms? (y*/n) y

Introduce tu correo electrónico y pulsa Entrar.

 Enter email(s) for notifications about problems and abuse (comma seperated): info@exoip.com

El resultado mostrará que está configurando el certificado Let's Encrypt.

 [autodiscover.exoip.com] Authorizing...
 [autodiscover.exoip.com] Authorizing using http-01 validation (SelfHosting)
 [autodiscover.exoip.com] Authorization result: valid
 [mail.exoip.com] Authorizing...
 [mail.exoip.com] Authorizing using http-01 validation (SelfHosting)
 [mail.exoip.com] Authorization result: valid
 Downloading certificate [Manual] mail.exoip.com
 Store with CertificateStore...
 Installing certificate in the certificate store
 Adding certificate [Manual] mail.exoip.com @ 2022/5/11 19:56:12 to store My
 Installation step 1/2: IIS...
 Our best match was the default binding and it seems there are other non-SNI enabled bindings listening to the same endpoint, which means we cannot update it without potentially causing problems. Instead, a new binding will be created. You may manually update the bindings if you want IIS to be configured in a different way.
 Our best match was the default binding and it seems there are other non-SNI enabled bindings listening to the same endpoint, which means we cannot update it without potentially causing problems. Instead, a new binding will be created. You may manually update the bindings if you want IIS to be configured in a different way.
 Adding new https binding *:443:mail.exoip.com
 Our best match was the default binding and it seems there are other non-SNI enabled bindings listening to the same endpoint, which means we cannot update it without potentially causing problems. Instead, a new binding will be created. You may manually update the bindings if you want IIS to be configured in a different way.
 Our best match was the default binding and it seems there are other non-SNI enabled bindings listening to the same endpoint, which means we cannot update it without potentially causing problems. Instead, a new binding will be created. You may manually update the bindings if you want IIS to be configured in a different way.
 Adding new https binding *:443:autodiscover.exoip.com
 Committing 2 https binding changes to IIS while updating site 1
 Installation step 2/2: Script...
 Script ./Scripts/ImportExchange.ps1 starting with parameters 'D8724E991E59BEA4D3EA364AC1E3EFB2668E932F' 'IIS,SMTP,IMAP' 1 'C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Certificates\PTQ-g6p-2E6SpcZkRfpOQA-9abaf6286b9e2fb42d8311899c4c9eb496dd699e-temp.pfx' '********' '[Manual] mail.exoip.com @ 2021/12/12 20:23:25'
 Script finished
 Adding Task Scheduler entry with the following settings
 - Name win-acme renew (acme-v02.api.letsencrypt.org)
 - Path C:\Program Files\Lets Encrypt
 - Command wacs.exe --renew --baseuri "https://acme-v02.api.letsencrypt.org/"
 - Start at 09:00:00
 - Random delay 04:00:00
 - Time limit 02:00:00

No queremos especificar un usuario para que se ejecute la tarea. Presione n y presione Entrar. La cuenta de usuario del SISTEMA se utilizará para ejecutar la tarea.

 Do you want to specify the user the task will run as? (y/n*) - no

 Adding renewal for [Manual] mail.exoip.com
 Next renewal due at 2022/7/5 19:55:25
 Certificate [Manual] mail.exoip.com created

Haga clic en Q y presione Entrar para salir de la aplicación Let's Encrypt Win-ACME.

 N: Create certificate (default settings)
 M: Create certificate (full options)
 R: Run renewals (0 currently due)
 A: Manage renewals (1 total)
 O: More options...
 Q: Quit

 Please choose from the menu: Q

El certificado Let's Encrypt está configurado correctamente en Exchange Server.

Instale el certificado Let's Encrypt usando la línea de comando

Ejecute el símbolo del sistema como administrador. Cambie la ruta a la carpeta Lets Encrypt y ejecute el comando. Agregue -verbose al final del comando para mostrarle lo que está sucediendo.

C:\>cd \program files\lets encrypt

C:\Program Files\Lets Encrypt>wacs.exe --target manual --host mail.exoip.com,autodiscover.exoip.com,download.mail.exoip.com --certificatestore My --acl-fullcontrol "network service,administrators" --installation iis,script --installationsiteid 1 --script "./Scripts/ImportExchange.ps1" --scriptparameters "'{CertThumbprint}' 'IIS,SMTP,IMAP' 1 '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'" --verbose

Después de ejecutar el comando, se le harán un par de preguntas sobre los Términos de servicio y se le pedirá que ingrese un correo electrónico.

Abrir Términos de servicio en la aplicación predeterminada: presione n para no abrir los términos de servicio. Siempre podemos consultar los términos de servicio abriendo el archivo PDF en el Explorador de archivos.
Aceptar los términos de servicio: presione y para aceptar los términos.
Correo electrónico: Introduzca su correo electrónico y presione Entrar.

Eche un vistazo a continuación para ver el resultado completo después de aceptar los Términos de servicio.

C:\>cd \program files\lets encrypt

C:\Program Files\Lets Encrypt>wacs.exe --target manual --host mail.exoip.com,autodiscover.exoip.com,download.mail.exoip.com --certificatestore My --acl-fullcontrol "network service,administrators" --installation iis,script --installationsiteid 1 --script "./Scripts/ImportExchange.ps1" --scriptparameters "'{CertThumbprint}' 'IIS,SMTP,IMAP' 1 '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'" --verbose
 [VERB] Verbose mode logging enabled
 [VERB] ExePath: C:\Program Files\Lets Encrypt\wacs.exe
 [VERB] ResourcePath: C:\Program Files\Lets Encrypt\
 [VERB] PluginPath: C:\Program Files\Lets Encrypt\
 [VERB] Looking for settings.json in C:\Program Files\Lets Encrypt\
 [DBUG] Config folder: C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org
 [DBUG] Log path: C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Log
 [DBUG] Cache path: C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Certificates
 [VERB] W3SVC detected and running
 [VERB] No FTPSVC detected
 [DBUG] secrets.json not found
 [VERB] Arguments: --target manual --host mail.exoip.com,autodiscover.exoip.com,download.mail.exoip.com --certificatestore My --acl-fullcontrol network service,administrators --installation iis,script --installationsiteid 1 --script ./Scripts/ImportExchange.ps1 --scriptparameters '{CertThumbprint}' 'IIS,SMTP,IMAP' 1 '{CacheFile}' '{CachePassword}' '{CertFriendlyName}' --verbose
 [DBUG] Renewal period: 55 days
 [VERB] Sending e-mails False

 [INFO] A simple Windows ACMEv2 client (WACS)
 [INFO] Software version 2.1.22.1260 (release, pluggable, standalone, 64-bit)
 [INFO] Connecting to https://acme-v02.api.letsencrypt.org/...
 [VERB] SecurityProtocol setting: SystemDefault
 [DBUG] Send GET to https://acme-v02.api.letsencrypt.org/directory
 [VERB] Request completed with status OK
 [DBUG] Connection OK!
 [DBUG] Running with administrator credentials
 [DBUG] IIS version 10.0
 [WARN] Scheduled task not configured yet
 [INFO] Please report issues at https://github.com/win-acme/win-acme
 [VERB] Unicode display test: Chinese/語言 Russian/язык Arab/لغة
 [INFO] Running in mode: Unattended
 [VERB] Adding 8.8.8.8 as DNS server
 [VERB] Adding 1.1.1.1 as DNS server
 [VERB] Adding 8.8.4.4 as DNS server
 [VERB] Parsed value for --host: mail.exoip.com,autodiscover.exoip.com,download.mail.exoip.com
 [VERB] No value provided for --commonname
 [INFO] Source generated using plugin Manual: mail.exoip.com and 2 alternatives
 [VERB] No value provided for --validationport
 [VERB] No value provided for --validationprotocol
 [VERB] Flag --ocsp-must-staple not present
 [VERB] Flag --reuse-privatekey not present
 [VERB] Parsed value for --certificatestore: My
 [VERB] Flag --keepexisting not present
 [VERB] Parsed value for --acl-fullcontrol: network service,administrators
 [VERB] No value provided for --ftpsiteid
 [VERB] Parsed value for --installationsiteid: 1
 [VERB] No value provided for --sslport
 [VERB] No value provided for --sslipaddress
 [VERB] Parsed value for --script: ./Scripts/ImportExchange.ps1
 [VERB] Parsed value for --scriptparameters: '{CertThumbprint}' 'IIS,SMTP,IMAP' 1 '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'

 [VERB] Source converted into 1 order(s)
 [DBUG] Reading certificate cache
 [DBUG] No cache files found for renewal
 [DBUG] Reading certificate cache
 [DBUG] No cache files found for renewal
 [VERB] Obtain order details for Main
 [VERB] No existing order found
 [VERB] Creating order for hosts: ["DnsName: mail.exoip.com", "DnsName: autodiscover.exoip.com", "DnsName: download.mail.exoip.com"]
 [VERB] Constructing ACME protocol client...
 [VERB] Getting service directory...
 [DBUG] Send GET to https://acme-v02.api.letsencrypt.org/directory
 [VERB] Request completed with status OK
 [DBUG] No account found at C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Registration_v2
 [VERB] No account found, creating new one
 [DBUG] Send GET to https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf
 [VERB] Request completed with status OK
 [VERB] Terms of service downloaded
 [VERB] Writing terms of service to C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\LE-SA-v1.2-November-15-2017.pdf

 Terms of service:   C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\LE-SA-v1.2-November-15-2017.pdf

 Open in default application? (y/n*) - no

 Do you agree with the terms? (y*/n) - yes

 Enter email(s) for notifications about problems and abuse (comma-separated): info@exoip.com

 [DBUG] Creating new ES256 signer
 [DBUG] Send HEAD to https://acme-v02.api.letsencrypt.org/acme/new-nonce
 [VERB] Request completed with status OK
 [DBUG] Send POST to https://acme-v02.api.letsencrypt.org/acme/new-acct
 [VERB] Request completed with status Created
 [DBUG] Saving signer to C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Signer_v2
 [DBUG] Saving account to C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Registration_v2
 [VERB] ACME client initialized
 [DBUG] Send POST to https://acme-v02.api.letsencrypt.org/acme/new-order
 [VERB] Request completed with status Created
 [VERB] Order https://acme-v02.api.letsencrypt.org/acme/order/539170266/87783048246 created
 [DBUG] Send POST to https://acme-v02.api.letsencrypt.org/acme/authz-v3/107516572406
 [VERB] Request completed with status OK
 [DBUG] Send POST to https://acme-v02.api.letsencrypt.org/acme/authz-v3/107516572416
 [VERB] Request completed with status OK
 [VERB] Handle authorization 1/2
 [INFO] [autodiscover.exoip.com] Authorizing...
 [VERB] [autodiscover.exoip.com] Initial authorization status: pending
 [VERB] [autodiscover.exoip.com] Challenge types available: ["http-01", "dns-01", "tls-alpn-01"]
 [VERB] [autodiscover.exoip.com] Initial challenge status: pending
 [INFO] [autodiscover.exoip.com] Authorizing using http-01 validation (SelfHosting)
 [VERB] Starting commit stage
 [VERB] Commit was succesful
 [DBUG] [autodiscover.exoip.com] Submitting challenge answer
 [DBUG] Send POST to https://acme-v02.api.letsencrypt.org/acme/chall-v3/107516572406/DsPOPQ
 [VERB] Request completed with status OK
 [VERB] SelfHosting plugin serving file /.well-known/acme-challenge/w7XzkVVwiXiMzx2QwJqSQkgwpemy6sVT-bts3XB3f6c
 [VERB] SelfHosting plugin serving file /.well-known/acme-challenge/w7XzkVVwiXiMzx2QwJqSQkgwpemy6sVT-bts3XB3f6c
 [VERB] SelfHosting plugin serving file /.well-known/acme-challenge/w7XzkVVwiXiMzx2QwJqSQkgwpemy6sVT-bts3XB3f6c
 [VERB] SelfHosting plugin serving file /.well-known/acme-challenge/w7XzkVVwiXiMzx2QwJqSQkgwpemy6sVT-bts3XB3f6c
 [DBUG] Refreshing authorization (1/15)
 [DBUG] Send POST to https://acme-v02.api.letsencrypt.org/acme/chall-v3/107516572406/DsPOPQ
 [VERB] Request completed with status OK
 [INFO] [autodiscover.exoip.com] Authorization result: valid
 [VERB] Starting post-validation cleanup
 [VERB] Post-validation cleanup was succesful
 [VERB] Handle authorization 2/2
 [INFO] [mail.exoip.com] Authorizing...
 [VERB] [mail.exoip.com] Initial authorization status: pending
 [VERB] [mail.exoip.com] Challenge types available: ["http-01", "dns-01", "tls-alpn-01"]
 [VERB] [mail.exoip.com] Initial challenge status: pending
 [INFO] [mail.exoip.com] Authorizing using http-01 validation (SelfHosting)
 [VERB] Starting commit stage
 [VERB] Commit was succesful
 [DBUG] [mail.exoip.com] Submitting challenge answer
 [DBUG] Send POST to https://acme-v02.api.letsencrypt.org/acme/chall-v3/107516572416/_yVW1w
 [VERB] Request completed with status OK
 [VERB] SelfHosting plugin serving file /.well-known/acme-challenge/NPd-4G3z1_o_g_EwNj4rFpW34gkDnSANgjyRWsFk9Kg
 [VERB] SelfHosting plugin serving file /.well-known/acme-challenge/NPd-4G3z1_o_g_EwNj4rFpW34gkDnSANgjyRWsFk9Kg
 [VERB] SelfHosting plugin serving file /.well-known/acme-challenge/NPd-4G3z1_o_g_EwNj4rFpW34gkDnSANgjyRWsFk9Kg
 [VERB] SelfHosting plugin serving file /.well-known/acme-challenge/NPd-4G3z1_o_g_EwNj4rFpW34gkDnSANgjyRWsFk9Kg
 [DBUG] Refreshing authorization (1/15)
 [DBUG] Send POST to https://acme-v02.api.letsencrypt.org/acme/chall-v3/107516572416/_yVW1w
 [VERB] Request completed with status OK
 [INFO] [mail.exoip.com] Authorization result: valid
 [VERB] Starting post-validation cleanup
 [VERB] Post-validation cleanup was succesful
 [VERB] Order 1/1 (Main): processing...
 [DBUG] Creating new private key at C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Orders\b5d3bcd2fa5ffa09c7962df544e418b8922717c7.order.keys...
 [DBUG] CSR stored at PwxG1EbkUkeYllA4pTvN1A-main-9abaf6286b9e2fb42d8311899c4c9eb496dd699e-csr.pem in certificate cache folder C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Certificates
 [VERB] Submitting CSR
 [DBUG] Waiting for order to get ready (1/15)
 [DBUG] Send POST to https://acme-v02.api.letsencrypt.org/acme/order/539170266/87783048246
 [VERB] Request completed with status OK
 [DBUG] Send POST to https://acme-v02.api.letsencrypt.org/acme/finalize/539170266/87783048246
 [VERB] Request completed with status OK
 [INFO] Downloading certificate [Manual] mail.exoip.com
 [DBUG] Send POST to https://acme-v02.api.letsencrypt.org/acme/cert/038380a9e2e6686f2e599cec3feee42be87d
 [VERB] Request completed with status OK
 [VERB] Parsing certificate from 5800 bytes received
 [VERB] Parsing PEM data at range 0..2048
 [VERB] Parsing PEM data at range 2050..3875
 [VERB] Parsing PEM data at range 3877..5799
 [DBUG] Send POST to https://acme-v02.api.letsencrypt.org/acme/cert/038380a9e2e6686f2e599cec3feee42be87d/1
 [VERB] Request completed with status OK
 [VERB] Parsing certificate from 3876 bytes received
 [VERB] Parsing PEM data at range 0..2048
 [VERB] Parsing PEM data at range 2050..3875
 [DBUG] Found 2 version(s) of the certificate
 [DBUG] Option 1 issued by DST Root CA X3 (thumb: 933C6DDEE95C9C41A40F9F50493D82BE03AD87BF)
 [DBUG] Option 2 issued by ISRG Root X1 (thumb: A053375BFE84E8B748782C7CEE15827A6AF5A405)
 [DBUG] Selected option 1
 [DBUG] Certificate written to cache file PwxG1EbkUkeYllA4pTvN1A-main-9abaf6286b9e2fb42d8311899c4c9eb496dd699e-temp.pfx in certificate cache folder C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Certificates. It will be reused when renewing within 1 day(s) as long as the --source and --csr parameters remain the same and the --force switch is not used.
 [VERB] Processing order 1/1: Main
 [VERB] W3SVC detected and running
 [VERB] No FTPSVC detected
 [DBUG] Certificate store: My
 [INFO] Store with CertificateStore...
 [INFO] Installing certificate in the certificate store
 [DBUG] Opened certificate store My
 [INFO] Adding certificate [Manual] mail.exoip.com @ 2022/5/11 20:17:25 to store My
 [VERB] CN=mail.exoip.com - CN=R3, O=Let's Encrypt, C=US (E5EB2A04299D2EA7D652EE919A563C00059E292E)
 [DBUG] Closing certificate store
 [VERB] Private key found at C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3f4cdf3b1f7376c3093ab6e08233d2a2_a3277ca2-c28c-4f25-ad1c-ecb55a72baa4
 [INFO] Add full control rights for network service
 [INFO] Add full control rights for administrators
 [VERB] CN=R3, O=Let's Encrypt, C=US - CN=ISRG Root X1, O=Internet Security Research Group, C=US (A053375BFE84E8B748782C7CEE15827A6AF5A405) already exists in CA
 [VERB] CN=ISRG Root X1, O=Internet Security Research Group, C=US - CN=DST Root CA X3, O=Digital Signature Trust Co. (933C6DDEE95C9C41A40F9F50493D82BE03AD87BF) already exists in CA
 [DBUG] Closing store CA
 [INFO] Installation step 1/2: IIS...
 [WARN] Our best match was the default binding and it seems there are other non-SNI enabled bindings listening to the same endpoint, which means we cannot update it without potentially causing problems. Instead, a new binding will be created. You may manually update the bindings if you want IIS to be configured in a different way.
 [WARN] Our best match was the default binding and it seems there are other non-SNI enabled bindings listening to the same endpoint, which means we cannot update it without potentially causing problems. Instead, a new binding will be created. You may manually update the bindings if you want IIS to be configured in a different way.
 [INFO] Adding new https binding *:443:mail.exoip.com
 [WARN] Our best match was the default binding and it seems there are other non-SNI enabled bindings listening to the same endpoint, which means we cannot update it without potentially causing problems. Instead, a new binding will be created. You may manually update the bindings if you want IIS to be configured in a different way.
 [WARN] Our best match was the default binding and it seems there are other non-SNI enabled bindings listening to the same endpoint, which means we cannot update it without potentially causing problems. Instead, a new binding will be created. You may manually update the bindings if you want IIS to be configured in a different way.
 [INFO] Adding new https binding *:443:autodiscover.exoip.com
 [INFO] Committing 2 https binding changes to IIS while updating site 1
 [DBUG] No update needed for default ftp site settings
 [INFO] Installation step 2/2: Script...
 [INFO] Script ./Scripts/ImportExchange.ps1 starting with parameters 'E5EB2A04299D2EA7D652EE919A563C00059E292E' 'IIS,SMTP,IMAP' 1 'C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Certificates\PwxG1EbkUkeYllA4pTvN1A-main-9abaf6286b9e2fb42d8311899c4c9eb496dd699e-temp.pfx' '********' '[Manual] mail.exoip.com @ 2022/5/11 20:17:25'
 [DBUG] Process launched: powershell.exe (ID: 6616)
 [VERB] NewCertThumbprint: E5EB2A04299D2EA7D652EE919A563C00059E292E
 [VERB] ExchangeServices: IIS,SMTP,IMAP
 [VERB] LeaveOldExchangeCerts: 1
 [VERB] RenewalId:
 [VERB] CacheFile: C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Certificates\PwxG1EbkUkeYllA4pTvN1A-main-9abaf6286b9e2fb42d8311899c4c9eb496dd699e-temp.pfx
 [VERB] FriendlyName: [Manual] mail.exoip.com @ 2022/5/11 20:17:25
 [VERB] Searching for Exchange snapin...
 [VERB] Microsoft.Exchange.Management.PowerShell.E2010
 [VERB] Microsoft.Exchange.Management.PowerShell.SnapIn
 [VERB] Checking if certificate can be found in the right store...
 [VERB] Waiting for process to finish...
 [VERB] Updating Exchange services...
 [VERB] Waiting for process to finish...
 [VERB] Certificate set for the following services: IIS,SMTP,IMAP
 [VERB] Process output without data received
 [VERB] Process error without data received
 [INFO] Script finished
 [VERB] Waiting for process to finish...
 [INFO] Adding Task Scheduler entry with the following settings
 [INFO] - Name win-acme renew (acme-v02.api.letsencrypt.org)
 [INFO] - Path C:\Program Files\Lets Encrypt
 [INFO] - Command wacs.exe --renew --baseuri "https://acme-v02.api.letsencrypt.org/"
 [INFO] - Start at 09:00:00
 [INFO] - Random delay 04:00:00
 [INFO] - Time limit 02:00:00
 [DBUG] Creating task to run as system user
 [INFO] Adding renewal for [Manual] mail.exoip.com
 [INFO] Next renewal due at 2022/7/5 20:16:38
 [INFO] Certificate [Manual] mail.exoip.com created
 [VERB] Exiting with status code 0

Win-ACME descargó con éxito el certificado Let's Encrypt para Exchange Server. También lo vinculó correctamente a los servicios de Exchange IIS, SMTP e IMAP.

En el próximo artículo, verificaremos la configuración de Let's Encrypt en Exchange Server. Continúe leyendo sobre cómo verificar el certificado Let's Encrypt.

¿Le ayudó instalar el certificado Let's Encrypt en Exchange Server?

Conclusión

En este artículo, aprendió cómo instalar el certificado Let's Encrypt GRATIS en Exchange Server. Diseñe y configure el espacio de nombres de Exchange antes de instalar el certificado Let's Encrypt. Recuerde habilitar el puerto 80 en el firewall. Si no lo hace, no podrá conectarse con Let's Encrypt para emitir un certificado.

¿Disfrutaste este artículo? También te puede interesar Obtener certificado Exchange con PowerShell. No olvides seguirnos y compartir este artículo.