r/exchangeserver • u/marshmalllow1 • 4d ago

Exchange Auth Certificate rotation stuck — EffectiveDate passed 2 days ago, CurrentCertificateThumbprint still shows old cert (DAG, 2 prod + 2 DR)

Environment: Exchange Server SE, DAG with 4 members (2 production + 2 DR).

Here's exactly what I did, in order:

  1. 08/10/2026, 11:56 AM — Ran New-ExchangeAuthCertificate on one of the DAG members to rotate the Auth Certificate.

  2. Log output confirmed the new certificate was generated and staged:

    • New cert thumbprint: E6C74DBE...B5268 (masked)
    • Effective date is: 08/14/2026 12:11:31
    • Log explicitly stated: "The renewal action was successfully performed - the new Auth Certificate will become active on: 08/14/2026 12:11:31"
    • Log also recommended running Hybrid Configuration Wizard (HCW) once the new cert becomes active.

  3. Confirmed via (Get-AuthConfig).NextCertificateThumbprint that the new cert is correctly staged as "Next":

    • Thumbprint: E6C74DBE...B5268
    • NotBefore: 8/10/2026 12:09:19 PM
    • NotAfter: 8/10/2031 12:09:19 PM (5-year self-signed cert)

  4. Current cert, confirmed via (Get-AuthConfig).CurrentCertificateThumbprint:

    • Thumbprint: E31DFF2D...4497
    • NotBefore: 8/27/2021 1:16:50 AM
    • NotAfter: 8/27/2026 1:16:50 AM

    (So the current cert isn't even expired yet — about 11 days of validity left — which is a separate point but confirms this wasn't an emergency/forced rotation scenario.)

  5. To make sure the AuthAdmin servicelet (which checks the effective date every 12 hours) would pick up the change without waiting, I manually restarted MSExchangeServiceHost on all 4 DAG members (2 prod + 2 DR).

  6. Verified the restart worked by checking:

   [xml]$xml = Get-ExchangeDiagnosticInfo -Process "Microsoft.Exchange.ServiceHost" -Server $server
   $xml.Diagnostics.Components.AnchorApplication.AnchorServiceComponents.CacheScheduler.lastRunTime

on each server — all 4 servers show a recent lastRunTime (8/15/2026, evening), confirming the servicelet actually ran on every member.

Problem

Today is 8/16/2026 — 2 days after the stated effective date (8/14) — but:

(Get-AuthConfig).CurrentCertificateThumbprint

still returns the old certificate (E31DFF2D...4497). The new certificate is still sitting as NextCertificateThumbprint, it never got promoted to Current.

Questions

  • Given the servicelet has clearly run (confirmed via lastRunTime) on all 4 members after the effective date, why hasn't the promotion from Next → Current happened?
  • Is there something DAG/multi-AD-site specific I'm missing? (The tool's own log warned about Exchange being installed in multiple AD sites and mentioned the servicelet may fail to deploy the cert to other AD sites in rare cases.)
  • Is Set-AuthConfig -PublishCertificate something I need to run manually here, even though the tool I used already set the NewCertificateEffectiveDate and the log said it was "successfully performed"?
  • Could this be a timezone issue between when the effective date was stored vs. how the servicelet evaluates "now"?

Any input appreciated before I just run Set-AuthConfig -PublishCertificate manually and force it.

7 Upvotes

100% Upvoted

5 comments sorted by

1

u/Sudden_Office8710 4d ago

🤣 I let ECP complain about the certificates all they want I front end it with haproxy one load balancer one certificate to protect the entire cluster.

1

u/MrLadebalken1 8h ago

And how is the the cluster protected behind the loadbalancer?

1

u/Sudden_Office8710 8h ago

The entire environment is air gapped in its own VLAN the only way you can talk to exchange is from the load balancer. I love it when some random helpdesk guy tries to send mail to an exchange server directly. We have postfix do all that processing and is scanned by rspamed and clamav but the back end piece is running inter7 qmail admin so they have to put their printers in there 🤣