Knowledge Base

Overview

By following this article, you will generate a Certificate Signing Request (CSR) in Microsoft Exchange Server 2019 and have a CSR file ready to submit to Sectigo, your Certificate Authority (CA). A Certificate Signing Request (CSR) is a block of encoded text that contains your organization and domain details; the CA uses it to issue your certificate. You run one command in the Exchange Management Shell, the PowerShell-based command-line tool for Exchange. The article covers the prerequisites, how to open the Exchange Management Shell, how to run the CSR command, how to retrieve the CSR file, and how to verify that the CSR was generated correctly.

Before you begin

Confirm the following before you start:

• Administrator access: You can sign in to the Exchange server with administrator privileges.
• Exchange Management Shell: The Exchange Management Shell is installed and available on the server.
• Certificate details: You know the country code, organization name, main domain name, and any additional domain names for the certificate.

Note: Microsoft ended support for Exchange Server 2019 on October 14, 2025. 

Open the Exchange Management Shell

1. Sign in to the Exchange server with administrator privileges.
2. Click Start, then click Exchange Management Shell.
   
    
   Figure 1: Opening Exchange Management Shell from the Windows Start menu. 

Expected result: The Exchange Management Shell window opens and shows a command prompt.

Run the CSR command

The following sample command generates a Certificate Signing Request (CSR) in the Exchange Management Shell and saves it to C:\certReq.txt.

New-ExchangeCertificate -GenerateRequest -SubjectName "c=XX, o=COMPANY NAME, cn=WWW.XXXXX.XXX" -DomainName DOMAIN.NAME, DOMAIN.NAME2 -PrivateKeyExportable $true | Set-Content -Path "C:\certReq.txt"

Before you run the command, replace each placeholder value as shown in the following table.

Placeholder	Replace with
XX	Your two-letter country code, for example US
COMPANY NAME	Your organization's legal name
WWW.XXXXX.XXX	The main domain name for the certificate, for example mail.example.com
DOMAIN.NAME, DOMAIN.NAME2	Each additional domain name that the certificate must cover, separated by commas

1. Copy the sample command into a text editor and replace the placeholder values.
2. Paste the updated command into the Exchange Management Shell window.
3. Press Enter and wait for the Exchange Management Shell to return to the command prompt.
4. Type exit and press Enter to close the Exchange Management Shell.
   
    
          Figure 2: Running the CSR generation command in Exchange Management Shell.
   
   

Expected result: The command finishes without an error, and the Certificate Signing Request (CSR) is saved to C:\certReq.txt.

Retrieve the CSR file

1. In File Explorer, go to C:\ and open the file certReq.txt in a plain text editor.
2. Copy the full Certificate Signing Request (CSR) text, including the first and last lines.
3. Paste the text into your Sectigo certificate order when the order asks for a CSR.

Verify the CSR

To confirm that the Certificate Signing Request (CSR) was generated correctly:

• Confirm that the file certReq.txt exists in C:\.
• Open the file and confirm that the text begins with -----BEGIN NEW CERTIFICATE REQUEST----- and ends with -----END NEW CERTIFICATE REQUEST-----.

If the file is missing or empty, run the command again and check that every placeholder value was replaced and that the shell was opened with administrator privileges.
 
      Figure 3: Opening the generated CSR file, certReq.txt, for submission to the Certificate Authority.

Similar questions

• How do I create a Certificate Signing Request (CSR) with the Exchange Management Shell?
• What is the New-ExchangeCertificate command for generating a CSR in Exchange 2019?
• Where does Exchange 2019 save the CSR file?
• How do I add multiple domain names to a CSR in Exchange 2019?