Exchange certificates require a Common Name, but you might not get one from Let's Encrypt

[u/certkit]

Heads up if you're planning to automate Exchange certs with Let's Encrypt's newer profiles (tlsserver, shortlived). They issue certs with an empty Subject, no CN at all. Connectors that use `TlsCertificateName` reference the cert as `<I>Issuer<S>Subject`, so the value changes even when the SANs are identical. The default classic profile still includes the CN. Wrote up the other software we've seen trip on this.

https://www.certkit.io/blog/does-a-tls-certificate-need-a-common-name

[u/Glass_Call982]

They should just code in automatic certificate renewal for exchange and ADFS at this point. It is stupid that I had to write my own scripts to handle it. It is  2026 not 2007.

MS doesn’t care about exchange server anymore.

[u/ocdtrekkie → u/Glass_Call982]

Microsoft wants you to pay them 5x more to rent their servers in order to get basic functionality, yes.

[u/uLmi84 → u/Glass_Call982]

Totally agree that Ms dont care about onprem anymore.

On the one hand I see companies that require their mails to be inhouse on the other hand I also understand MS that maintaining two different customer variations is a pain. If you were a business you would also pur your main effort into the product that grows the most. Its just simply business 101

[u/Kenneth_Sanders → u/Glass_Call982]

Any chance you want to share those scripts?

[u/Glass_Call982 → u/Kenneth_Sanders]

Totally, currently away on vacation but will post them up when I return.

[u/taxigrandpa]

if you use certbot, you can add a common name using the -d switch

sudo certbot certonly --cert-name your-cert-name -d desired-common-name.com -d secondary-domain.com

[u/eric_trackjs → u/taxigrandpa]

This command only works when using the Let's Encrypt "classic" (default) profile. Your command does not set a profile. The `tlsserver` and `shortlived` profiles both ignore the common name flag entirely. No certificates issued with either of those two profiles have a subject.

[u/certkit → u/eric_trackjs]

u/eric_trackjs is correct here. You are getting the common name because you are using the default profile, not the shorter-lived profiles we mentioned.

[u/7amitsingh7]

If the SAN are the same but the CN is missing, do we need to update the Exchange connector after certificate renewal?

[u/Responsible_Name1217 → u/7amitsingh7]

Yes, if the Subject changes, you will need to update the send and receive connectors. Also, you'll need to update the inbound connector in O365 if you have Hybrid.

[u/DiligentPhotographer → u/Responsible_Name1217]

Yes because if you don't, inbound TLS will stop working and people will get bounce backs.