"The SSL certificate is expired" when using AppInsight for Exchange template

When AppInsight for Exchange Server, or a Server which is being attempted to add into monitoring fails with the following error message:

Connecting to remote server XXX.XXX.XXX.XXX failed with the following error message: The server certificate on the destination computer (XXX.XXX.XXX.XXX:5986) has the following errors: The SSL certificate is expired.


On the Exchange Server, MMC can be used to view the expired Certificate:
 

1. Click Run, then type type MMC.
2. Go to File > Add/Remote Snap-in.
3. Select Certificates then click Add.
4. Select the Computer Account option.
5. In the left-hand pane, expand Certificates > Personal > Certificates.

The certificate which Orion created can be seen with the following naming convention: xxx.xxx.xxx.xxx_Solarwinds_Zero_Configuration. You can view the Expiration Date from the Certificate from this Window

This issue occurs due to the SSL certificate which the Exchange is attempting to use has expired.

Remove the existing WinRM listener that is using the expired certificate:
 

1. Open an elevated command prompt or PowerShell prompt.
2. View the currently existing listener with the following command:

    winrm get winrm/config/listener?Address=*+Transport=HTTPS

3. The CertificateThumbprint will match what is seen on the certificate.
4. To remove the listener, use the following command:

   winrm delete winrm/config/Listener?Address=*+Transport=HTTPS

Remove the expired certificate with MMC

1. Click Run, then type MMC.
2. Go to File > Add/Remote Snap-in.
3. Select Certificates then click Add.
4. Select the Computer Account option.
5. In the left-hand pane, expand Certificates > Personal > Certificates.
6. Right-click the certificate which should be named as follows: xxx.xxx.xxx.xxx_Solarwinds_Zero_Configuration.
7. Click Delete.

Install the New Certificate

1. Open Microsoft Management Console (MMC)
2. Navigate to Certificates (Computer Account)
3. Import the certificate into Personal > Certificates

Get The Certificate Thumbprint

1. Open PowerShell and run:

Get-ChildItem -Path Cert:\LocalMachine\My

2. Copy the Thumbprint of the new certificate (remove any spaces)

Recreate the certificate and the WinRM Listener
 

1. Re-run the automatic configuration via Edit Application Monitor for AppInsight for Exchange, or
2. Perform the manual configuration steps for the certificate and the WinRM listener:
   • Run the following in Powershell (as admin):

winrm create winrm/config/Listener?Address=*+Transport=HTTPS "@{Hostname='HOSTNAME';CertificateThumbprint='THUMBPRINT';Port='5986'}"

Replace:

• • HOSTNAME with machine's FQDN
  • THUMBPRINT with the new certificates thumbprint (no spaces)

Note: If the above does not resolve the issue make sure the certificate if assigned to the HTTPs binding in IIS.