Microsoft has released Security Updates (SUs) for vulnerabilities found in:
Exchange Server Subscription Edition (SE)
Exchange Server 2019
Exchange Server 2016
SUs are available for the f...
Updated Aug 13, 2025
Version 4.0
Blog Post
Based on exchange server 2016 cu23, after installing KB5063223. I found that after entering the "Get-ExchangeCertificate" command in EMS, there was no output. The certificate information can be seen before the patch is installed. There are constantly logs about certificate errors during the event. for example, as follows: "There is no valid SMTP Transport Layer Security (TLS) certificate for the FQDN of xxxdomain.com"
The original certificate cannot be re-imported either, and it will prompt that the certificate already exists.
May I ask how I need to handle it? Thank you.
Bhalchandra_Atre-MSFTMicrosoft
chaoqun Couple of things to check: 1) Launch the EMS in admin mode 2) Check if the auth certificate is missing.
Thank you for your reply. EMS has been initiated by admin, and the self-signed certificate is currently expired. However, on another machine that has not installed the KB5063223 patch, the certificate can be queried through command.
So do you suggest updating the auth certificate?You should definitely get the auth cert renewed ASAP, it's not hard to do.
Otherwise you'll get odd symptoms like OWA/EAC not working properly, hybrid issues etc.
Quite possible the update has introduced a glitch or that it's purposely not showing expired certs for some reason.
EAC would show the cert as Invalid if it is expired or CRL can't be verified, can't remember what the command line shows by default.