1. step
New-ExchangeCertificate -generaterequest:1 -domainname domain.com,mail.domain.com,smtp.domain.com,pop3.domain.com -privatekeyexportable:1 -path c:cert.txt -force:1

2. step
Import certificate request using web access to your Certification authority – logon as administrator! (WEB SERVER!!!)

3. step
Export certificate to a location on the disk… c:certnew.crt

4. step
Import-ExchangeCertificate -path c:certnew.cer

5. step
Enable-ExchangeCertificate -thumbprint 5ACC9A5D90E2CFDBAD6E25CD02362B8954506810 -Services “IIS,POP,SMTP,IMAP”

To remove old certificates:
Remove-ExchangeCertificate -Thumbprint …………