Powershell Error when deploying certs to IIS / Exchange

killom · May 4, 2026, 6:50pm

Currently evaluating CCM Version 7.0.18.0,

now stuck on an issue with deploying a cert to Exchange 2019 on Server 2019:

2026-05-04 15:53:06.736 +02:00 [INF] Task [Deploy to Exchange] :: Task is enabled and primary request was successful.
2026-05-04 15:53:06.736 +02:00 [INF] Executing command via PowerShell
2026-05-04 15:53:06.867 +02:00 [ERR] Powershell Task Completed.Error: Add-PSSnapIn: The term 'Add-PSSnapIn' is not recognized as a name of a cmdlet, function, script file, or executable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:7 char:1
+ Add-PSSnapIn Microsoft.Exchange.Management.PowerShell.E2010
+ ~~~~~~~~~~~~
Error: Enable-ExchangeCertificate: The term 'Enable-ExchangeCertificate' is not recognized as a name of a cmdlet, function, script file, or executable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:28 char:2
+     Enable-ExchangeCertificate -Thumbprint $result.ManagedItem.Certif …
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~

It looks like, the context where those PS commands are run, doesnt know those commands. But I am able to run these cmdlets manually via PS shell.

Any hint on, where to search for reason why this fails?

Thanks

webprofusion · May 5, 2026, 1:15am

HI @killom we are seeing a few compatibility issues being raised recently for powershell in v7. Internally we use powershell 7.x but it seems like the recent update may have reduced compatibility and we’re looking at different strategies to resolve that with an update. It looks like we may have to resort to PS5.1 by default on windows.

In the meantime our internal script for Exchange is this one:

github.com/webprofusion/certify-plugins

src/DeploymentTasks/Core/Providers/Assets/Exchange.ps1

development

# This script enables the use of the newly retrieved and stored certificate with common Exchange services
# For more script info see https://docs.certifytheweb.com/docs/script-hooks

param($result, $services, [switch] $cleanupPreviousCerts = $false, [switch] $addDoNotRequireSslFlag = $false)

# enable powershell snap-in for Exchange 2010 upwards
Add-PSSnapIn Microsoft.Exchange.Management.PowerShell.E2010

Write-Host "Enabling Certificate for Exchange services.."
		


if ($addDoNotUseSslFlag -eq $true)
{
	$args = @{ 
		Thumbprint = $result.ManagedItem.CertificateThumbprintHash; 
		Services = $services; 
		Force = $true;
		ErrorAction = Stop;
	}

This file has been truncated. show original

I would suggest using this variant with the Run a Powershell script task, and enable Launch as New Process under task parameters, that way it will use the system powershell instead of the inprocess powershell runtime we provide.

killom · May 5, 2026, 10:20am

@webprofusion Thank you very much for your feedback,

is it possible to force the current version of CCM to use PS5.1 or downgrade CCM to an earlier version where this compatibility issue has not yet been introduced?

I would prefer to try one of those two options to resolve the current issue rather than apply your suggested workaround, as you workaround “does not correspond to the intended behavior of the certificate provisioning process for onprem Exchange.”

Thanks so far!

Edit:
Unfortunately there is no mention of the transition from PS5.1* to PS7.x (or reducing 7.x compatibility?) in the CCM Changelogs. Release Notes - Certify Certificate Manager - Certify The Web - ACME Certificate Management for Windows and Linux, simple free certificates for IIS and more, powered by Let's Encrypt and other ACME CAs

I tried the previous version, 7.0.17.0, but it seems the problem already existed in there?

* I was wondering, because Add-PSSnapIn cmdlet has never been ported over to PowerShell Core 6 and onward - so I guess you used PS5.1 for this in an earlier version?

webprofusion · May 5, 2026, 12:23pm

Yeah we didn’t realize the scope of the PS compatibility issue. There is approximately 3-4 years of development between CCM 6.x and 7.x. 6.x has been in maintenance mode for a while and 7.x has been a large endeavor.