Any updates on the ACME certificate automation for mailenable

[supportweb]

HI All.

I have searched the site for ACME setup instructions or assistance and can see the last mention of it appears to be Nov 2023
With it now being Sep 2025 i was wondering if any progress had been made on this front.

We are now in the process of moving all our certificate renewals over to simple-acme/win-acme via either Let's Encrypt or Sectigo
And have hit out Mailenable server turn, the IIS sites Webmail and Mailadmin or Easy and straightForward.

Has any advancement been made on installing the new cert into Mailenable system automatically?
Has anyone come up with a clever trick to make it work automatically?

[myourchisin]

I personally just finished migration of our ten year old ME server from a cloud hosted VPS to our dedicated server in our datacenter racks while upgrading to the Enterprise version.

Using the win-acme utility with LetsEncrypt, was pretty easy and straight forward, it took all of about 5 minutes to run the utility on our new ME server where it placed the new cert in the website certificate store, which was nice b/c the one cert covered all 25 domains hosted through ME on the server. The only extra step I had to do was copy and place it in the Personal >> Certificates within the certificates manager under MMC.exe.

It even made an entry in the Task Scheduler to auto update the cert.

I don't know if it answers your question, but honestly I can't see the process being any easier if it were even integrated within Mail Enable. Really, when it come to the overall process of migration/setup of the ME server, installing the Certificates via win-ACME was about the simplest thing. Webmail access and SSL connections all working and secure as they should be and took about 5 minutes to complete. I just followed the guides provided by MailEnable KB.

Hope this helps, but let me know if you need more.

[supportweb]

Hi, Thanks for the reply.

Yes i agree the win-acme process is straightforward and works well
Like i mention both my web-mail and mailadmin Certs are automatically renewed and attached to my iis sites.
I was just looking to see if the process of attaching the certificate to the Mailenable core had changed in anyway, or if it was still a manual process of going into localhost selecting the new certificate and applying manually.
We have already added an additional step to our Maintenance schedule to do this, But automation would be much better.

Can you link the KB you mentioned?

[geotek]

Renewing the web certificate with win-acme is indeed straightforward, but replacing the imap and smtp certificate needs extra work:

• Open the MS Certificate window and give the appropriate ME service read rights to the private key
• Open ME Management and assign the new certificate - but wait, both have the same name making it unclear which is the new one.
• Deleting the old certificate in MS Cert manager allows to see only the new certifice in ME Admin, but as soon as the certificate is removed, Mailanable SSL processing is broken.
• To avoid losing Emails after deleting the old certificate, SMTP and IMAP services need to be shut down, but this also interrupts Email services, so this isn't a solution either, This prevents us to renew ME Certificates during working hours.

I think this workflow definitively needs simplification, or am I missing something?

[supportweb]

Yes, it should just be possible to automatically renew and install these certificates on the system

[geotek]

Yes, it should just be possible to automatically renew and install these certificates on the system

Glad to hear that, but I can't find a reliable way to automate the manual steps needed for Malenable to accept and use the new certificate. Could you please help?

[supportweb]

I mean it should be possible, but as far as I am aware it isn't! For now we have put a different one year cert on mailenable services in the hope that this is resolved in the next 12 months.

[myourchisin]

Apologies, I made my post, and completely lost track of checking back on this discussion.

Renewing the web certificate with win-acme is indeed straightforward, but replacing the imap and smtp certificate needs extra work:

• Open the MS Certificate window and give the appropriate ME service read rights to the private key
• Open ME Management and assign the new certificate - but wait, both have the same name making it unclear which is the new one.
• Deleting the old certificate in MS Cert manager allows to see only the new certifice in ME Admin, but as soon as the certificate is removed, Mailanable SSL processing is broken.
• To avoid losing Emails after deleting the old certificate, SMTP and IMAP services need to be shut down, but this also interrupts Email services, so this isn't a solution either, This prevents us to renew ME Certificates during working hours.

I think this workflow definitively needs simplification, or am I missing something?

As geotek posted, (and I believe you described in your initial post), the win-acme setup is pretty straight forward, and easy to setup, even with multiple domains under one base server IP (as in our own hosting situation). However,...

Hi, Thanks for the reply.

Yes i agree the win-acme process is straightforward and works well
Like i mention both my web-mail and mailadmin Certs are automatically renewed and attached to my iis sites.
I was just looking to see if the process of attaching the certificate to the Mailenable core had changed in anyway, or if it was still a manual process of going into localhost selecting the new certificate and applying manually.
We have already added an additional step to our Maintenance schedule to do this, But automation would be much better.

Can you link the KB you mentioned?

After running the system for roughly 6 months, we've found the renewal process of win-acme to be wonderfully automated, but the integration into Mail Enable not so much. Our Certificates renew every 3 months, (Something I'd like to extend to 1yr, but just haven't' had the time to sit down and figure it out, if you happen to have any pointers on extending the certificate expiration for win-acme I'd much appreciate it!), but it seems when the certificate renews Mail Enable does not see this, so what happens is we have clients using Outlook to connect to retrieve mail via POP3 fail to connect, they then notify me, and I log into our Server reselect the already selected certificate under local host >> SSL, then restart all service. Takes about 30 seconds and everything is running again. It is annoying because it's hard to keep a timer when win-amce will update the certs, and often does it earlier than the expiration dates. I'd prefer to not have clients notice downtime.

I assume this is the process you refer to wanting automation for, I've just yet to find a solution for automation of the ME cert renewal.

It would be nice to maybe get Forum Admin's attention to this thread, and feedback.

[Admin]

With SNI, MailEnable will load the certificate as needed. And if there are multiple certs with the same name it will use the one that is valid (i.e. it loops through until it finds a valid one, otherwise will use that last one found). If you are running the services under IME_SYSTEM then this will need to have permissions on the certs. I will need to check, but if you are using an SSL port, this needs to load the cert first so it has it when accepting connections - this is likely the issue with POP3 since it does not support STARTTLS. Feel free to send a Debug log through to support@mailenable.com if you want someone to check/help resolve the issue.

[myourchisin]

With SNI, MailEnable will load the certificate as needed. And if there are multiple certs with the same name it will use the one that is valid (i.e. it loops through until it finds a valid one, otherwise will use that last one found). If you are running the services under IME_SYSTEM then this will need to have permissions on the certs. I will need to check, but if you are using an SSL port, this needs to load the cert first so it has it when accepting connections - this is likely the issue with POP3 since it does not support STARTTLS. Feel free to send a Debug log through to support@mailenable.com if you want someone to check/help resolve the issue.

Thanks so much for putting eyes on this, I will for sure send a debug over this week, as well as do some digging in my configuration to make sure all permissions are set as you noted, and look into the SSL port we strictly use 995/465, (I'm not not familiar with setting this to load first, but I will again look further into this.) Thanks!

[supportweb]

And if there are multiple certs with the same name it will use the one that is valid (i.e. it loops through until it finds a valid one, otherwise will use that last one found).

Thanks for the clarification, Just to better understand that behaviour:

When multiple certificates exist with the same name and MailEnable loops through until it finds a valid one, is there any defined order to how those certificates are evaluated?
For example, is it based on:

• certificate store order
  thumbprint order
  issue date
  expiry date

Or does it simply take the first valid certificate it encounters in whatever order Windows presents them?
The reason I ask is because with ACME renewals (for example Let’s Encrypt), multiple certificates with the same subject naturally build up over time, all with different expiry dates.
In that situation, is there any way to make MailEnable consistently prefer the certificate with the longest remaining validity, rather than potentially selecting an older certificate that is still technically valid but closer to expiry?

We are trying to understand whether this can be made predictable enough for automation, or whether certificate cleanup is still the safer route.

[geotek]

My observation is: If a new certificate is generated with the same name as the old one, Mailenable wil NOT take the newer one after service restart but will stick with the previous one.

Please give us a scriptable mechanism to force Mailenable in taking the newest Cert. Failing to have a reliable mechanism for automated certificate renewal is outdated.

[kiamori]

This is the automated process that works for us, any number of domains 1 or 10,000, it doesn't matter.

You can use any SSL automation tools, WACS acme/lets encrypt tool to create the automated renewal schedule.

Initially IME_System or whatever you have configured for ME will need full control of HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates

then Win-ACME supports Post-Execution Scripts:

use something like this: (be sure to set the post execution script in wacs or your preferred SSL renewal tool)

Code: Select all

param($result)  # Win-ACME passes renewal result

# Stop MailEnable services
Stop-Service -DisplayName "MailEnable*" -Force -ErrorAction SilentlyContinue

# Find the certificate (adjust CN or use thumbprint from $result)
$certSubject = "yourdomain.com"  # Or better: use $result.ManagedItem.CertificateThumbprintHash if available
$cert = Get-ChildItem -Path Cert:\LocalMachine\My | 
        Where-Object { $_.Subject -like "*$certSubject*" -or $_.Thumbprint -eq $result.ManagedItem.CertificateThumbprintHash } | 
        Sort-Object NotAfter -Descending | Select-Object -First 1

if (-not $cert) {
    Write-Error "Certificate not found!"
    exit 1
}

# Grant IME_SYSTEM full control on private key
$permission = "IME_SYSTEM", "Read,FullControl", "Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission

$keyPath = Join-Path $env:ProgramData "Microsoft\Crypto\RSA\MachineKeys\"
$keyName = $cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName
$keyFullPath = Join-Path $keyPath $keyName

try {
    $acl = Get-Acl -Path $keyFullPath
    $acl.AddAccessRule($accessRule)
    Set-Acl -Path $keyFullPath -AclObject $acl
    Write-Host "Permissions granted to IME_SYSTEM for $($cert.Subject)"
} catch {
    Write-Error "Failed to set permissions: $_"
    throw
}

# Restart services
Start-Service -DisplayName "MailEnable*"
Write-Host "MailEnable services restarted."

Note:
For some SSL cert solutions you need to import the .ca-bundle(.crt)
In the Certificates MMC (Computer account):
Go to Intermediate Certification Authorities -> Certificates.
Right-click -> All Tasks -> Import the intermediate certificate(s).