CSRs created by Exchange are signed with outdated signature algorithm

Symptoms 

When you run New-ExchangeCertificate, Microsoft Exchange Server uses the outdated sha1WithRSA signature algorithm to sign the Certificate Signing Request (CSR). Some Certification Authorities (CA) don't accept the CSR if it's signed by using this outdated signature algorithm.

Resolution 

To fix this issue, install the following security update:

• Description of the security update for Microsoft Exchange Server 2019 and 2016: November 12, 2024 (KB5044062)