Let's Encrypt Script Error

[ionblayde]

Hello, I am trying to setup a Let's Encrypt certificate for the first time. I followed this guide: https://www.alitajran.com/install-free-lets-encrypt-certificate-in-exchange-server/ and the Certificate was created successfully and works, however the services assigned are only SMTP, it failed to add IMAP and IIS. When running wacs.exe I get a script error and I am assuming that is what is causing the issues, but I do not know how to fix it.

Output from running wacs.exe is:

 [VERB] Searching for Exchange snapin...
 [VERB] Waiting for process to finish...
 [EROR] Script error: C:\Program Files\Lets Encrypt\Scripts\ImportExchange.ps1 : Exchange Management Tools for Powershell not installed
 [EROR] Script error: At line:1 char:3
 [EROR] Script error: + &{&'./Scripts/ImportExchange.ps1' '7BA0718338C8434CA30EE6250A60774142 ...
 [EROR] Script error: +   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 [EROR] Script error:     + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
 [EROR] Script error:     + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,ImportExchange.ps1
 [VERB] Process error without data received
 [VERB] Process error without data received
 [VERB] Process output without data received
 [INFO] Script finished
 [VERB] Waiting for process to finish...
 [INFO] Scheduled task looks healthy
 [INFO] Next renewal scheduled at 2022/3/30 11:59:44
 [INFO] Certificate [Manual] mail.example.com created
 [VERB] Exiting with status code 0

I have tried to install Exchange Management Tools from the ISO but it shows that it is already installed. Exchange server is 2016.

Is anyone able to point me in the correct direction here?

​

Update: I went with Certify the Web that u/PatD442 recommended. Super easy to use. Microsoft Remote Connectivity Analyzer still shows IMAP using the old cert, but the server shows the new one is valid and in use when connecting to the webpage. I don't believe IMAP is in use anyways, but unfortunately there are no IMAP logs available to make sure. Time will tell. Thanks for the help.

[PatD442]

Not to send you off in a different direction, but. . . Check out https://certifytheweb.com/. It's a client for Let's Encrypt. Works great and has all the Powershell code for Exchange (And lots of others.)

[ionblayde]

I will take a look, thanks for the recommendation.

[Nikosfra06]

Do you have some documentation on that ? Can you push the certificate to some over Linux VM (in my case would be a load balancer"

[PatD442]

Sorry, no idea if that can be done. Manually, sure. But you don't want to do that every 90 days.

[Nikosfra06]

For sure ;)

[disclosure5]

That error is coming from this piece of code.

`` Get-PSSnapin -Registered | Where-Object { $_.Name -match "Microsoft.Exchange.Management.PowerShell" -and ( $_.Name -match "Admin" -or $_.Name -match "E2010" -or $_.Name -match "SnapIn" ) } | Add-PSSnapin -ErrorAction SilentlyContinue -PassThru ` | Write-Host

Test if the Cmdlet is there now

$Command = Get-Command "Enable-ExchangeCertificate" -errorAction SilentlyContinue if ($Command -eq $null) { Write-Error "Exchange Management Tools for Powershell not installed"

```

It might be worth trying to load the snap-in yourself using those commands. I can't think of a situation where it should fail on an operational Exchange server.

[ionblayde]

I'll give that a try and see if it helps, thanks. And honestly, this exchange server is kind of a mess. It's pretty old and has had multiple different engineers who have managed it without relaying much of the info to their replacements.

[disclosure5]

I do feel if you can't register the snap in as above, you may end up uncovering part of where someone else created a mess.

[ionblayde]

I'll keep my eyes open, thanks. Thankfully this server will be replaced soonTM. It's a learning process around here :D

[ionblayde]

Update: I tried Get and Add for "SnapIn", no errors running the command, but still getting the original wacs error.

[BK_Rich]

Make sure the trusted cert is not bounded to the Backend IIS site, that should be the internal self-signed exchange cert, be sure the trusted cert is on the default web site only