Exchange 2019 Certificate Request not generating TXT file

Susan Dodds 421 Reputation points
2026-08-15T11:38:33.8366667+00:00

Exchange 2019 Cu14.

Not getting the text file for my certificate request to send to the CA.

Pending request is showing up in the EAC but can't do more with it in the EAC in Cu14.

Folder is shared and allows access to Exchange Trusted Subsystems.

[System.IO.File]::WriteAllBytes('C:\Certs\certrequest.req', [System.Text.Encoding]::Unicode.GetBytes($txtrequest))
Exchange | Exchange Server | Management
Exchange | Exchange Server | Management

The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.

0 comments
Answer accepted by question author

AI answer

2026-08-15T11:38:48.9133333+00:00

In Exchange Server 2019, this behavior is expected in CU14.

The Exchange admin center can be used to manage certificates only in Exchange Server 2019 CU15 and later. For Exchange Server 2019 CU12 to CU14, the supported method is Exchange Management Shell.

Also, in Exchange 2016 and Exchange 2019, the RequestFile parameter is not available for New-ExchangeCertificate. The supported approach is:

  1. Generate the request into a variable:
$txtrequest = New-ExchangeCertificate -GenerateRequest -SubjectName "C=US,CN=mail.contoso.com" -DomainName autodiscover.contoso.com,mail.contoso.com
  1. Write that variable to a request file:
[System.IO.File]::WriteAllBytes('C:\Certs\certrequest.req', [System.Text.Encoding]::Unicode.GetBytes($txtrequest))
  1. Send the resulting .req file to the CA.

Important checks for the current scenario:

  • Confirm $txtrequest actually contains data before writing the file.
  • Confirm C:\Certs already exists. The folder path must already exist before writing the request file.
  • The SubjectName must include at least CN=<HostNameOrFQDN>. Including C=<CountryOrRegion> is recommended, because otherwise certificate renewal might fail.
  • If a DER-encoded request is required by the CA, use -BinaryEncoded and write $binrequest.FileData instead.

Example for DER-encoded output:

$binrequest = New-ExchangeCertificate -GenerateRequest -BinaryEncoded -SubjectName "C=US,CN=mail.contoso.com" -DomainName autodiscover.contoso.com,mail.contoso.com
[System.IO.File]::WriteAllBytes('C:\Certs\certrequest.pfx', $binrequest.FileData)

If a pending request already exists and the original request file is missing, the pending certificate request can be exported and resubmitted to the CA:

$txtcert = Export-ExchangeCertificate -Thumbprint <Thumbprint>
[System.IO.File]::WriteAllBytes('C:\Certs\certrequest.req', [System.Text.Encoding]::Unicode.GetBytes($txtcert))

That export works for a pending certificate request, but it cannot be imported on another server.

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Oldest
Most helpful Newest Oldest
  1. Susan Dodds 421 Reputation points
    2026-08-15T11:49:16.6266667+00:00

    I apologize.

    I was working with a VM where the window wasn't maximized and was looking at the host and not the VM file explorer so I was essentially looking on the wrong computer.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.