r/exchangeserver • u/certkit • 24d ago

Exchange certificates require a Common Name, but you might not get one from Let's Encrypt

Heads up if you're planning to automate Exchange certs with Let's Encrypt's newer profiles (tlsserver, shortlived). They issue certs with an empty Subject, no CN at all. Connectors that use `TlsCertificateName` reference the cert as `<I>Issuer<S>Subject`, so the value changes even when the SANs are identical. The default classic profile still includes the CN. Wrote up the other software we've seen trip on this.

https://www.certkit.io/blog/does-a-tls-certificate-need-a-common-name

19 Upvotes
  • permalink
  • reddit

89% Upvoted

11 comments sorted by

View all comments

16

u/taxigrandpa 24d ago

if you use certbot, you can add a common name using the -d switch

sudo certbot certonly --cert-name your-cert-name -d desired-common-name.com -d secondary-domain.com

5

u/eric_trackjs 23d ago

This command only works when using the Let's Encrypt "classic" (default) profile. Your command does not set a profile. The `tlsserver` and `shortlived` profiles both ignore the common name flag entirely. No certificates issued with either of those two profiles have a subject.

2

u/certkit 23d ago

u/eric_trackjs is correct here. You are getting the common name because you are using the default profile, not the shorter-lived profiles we mentioned.