win-acme: Not enough memory resources on Exchange Server (with RAM to spare!)

Today I had an Exchange Server SE machine refusing to renew its certificate through win-acme. The error was wonderfully helpful:

Error - ("CryptographicException"): "Not enough memory resources are available to complete this operation."
Error - Renewal for "[Manual] mail.example.com" failed, will retry on next run
Error - Not enough memory resources are available to complete this operation.

The server had 16 GB of RAM, with about 4 GB free. Enough for a tools-only Exchange server... hardly swimming in memory, but enough to make me question whether throwing more RAM at it was really the answer.

It turned out an October Windows Server update was the rather more useful thing to investigate.

The setup

This was win-acme 2.4.0.2350, with the following renewal configuration:

I've replaced the real mail hostname with mail.example.com in the examples.

The exception pointed towards a cryptographic operation, but the short error report didn't tell us precisely which operation had failed. There wasn't enough here to declare that the machine had simply run out of physical memory.

Someone else had considerably more free RAM

A search turned up simple-acme issue #775, reporting the same exception on Windows Server 2025. That server had 34.6 GB free. So much for assuming another few gigabytes would sort it!

The discussion linked the failure to the October 2026 Windows Server updates. Another administrator reported that applying the Exchange workaround stopped the certificate error, and the original reporter subsequently confirmed it worked for them too.

That was a useful lead, rather than proof about our own server. The next step was to check its installed updates.

Check the Windows update

Microsoft's advisory lists these updates in connection with Exchange instability:

You can check for them in PowerShell:

Get-HotFix | Where-Object HotFixID -in @(
    'KB5126646',
    'KB5126655',
    'KB5126651',
    'KB5126868'
)

Our server had the affected update installed. Combined with the matching certificate error, that made the documented workaround worth trying.

The workaround

Microsoft recommends keeping the updates installed, setting the following registry value and restarting the affected server. Run this from an elevated Command Prompt or PowerShell window:

reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f

This changes the RPC Endpoint Mapper setting, rather than allocating more RAM to the VM. The /f switch overwrites an existing value, so check and record it first if you've already configured this setting.

To verify the stored value in PowerShell:

Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Rpc" -Name "EpmapSavedContextCap"

Expected output:

65536

Restart the server afterwards, scheduling the interruption around Exchange availability. Setting the value alone isn't the complete procedure.

We applied the workaround, and the renewal subsequently worked. No extra RAM required to resolve this particular error.

One small catch when testing

There was a slightly misleading moment along the way. The follow-up win-acme screen was reported as showing:

Renewal [Manual] mail.example.com is due after 2026-11-21

Running an ordinary renewal when the certificate isn't due can skip it. No error, but no certificate renewal either. Easy to mistake that for a successful test when you're pleased the red text has gone away!

To exercise the renewal, select the affected entry in the renewal manager and use S: Run the renewal (force). For a command-line retry from the win-acme installation directory:

.\wacs.exe --renew --force --verbose

That command processes the configured renewals, so use the renewal manager to select just the affected one if the installation manages several. The switches are covered in win-acme's renewal troubleshooting guidance.

The completed renewal was confirmed afterwards; the earlier skipped attempt wasn't the evidence for it.

Don't forget the Exchange side

Our installation plugin was Manage IIS bindings. After renewing, check the IIS binding and the certificate used by Exchange, including SMTP where applicable.

In the Exchange Management Shell, this is a useful starting point:

Get-ExchangeCertificate |
    Format-List Thumbprint, Subject, CertificateDomains, NotAfter, Services, Status

Microsoft documents these certificate properties here. Compare the expected certificate and expiry date, and check the services that actually use it. A certificate in the store is only part of the job.

For this failure, the useful combination was the exact exception, an affected Windows update and the matching report from another administrator. The memory error alone wouldn't have established the cause.

As of 23 October 2026, Microsoft still describes the registry change as a workaround and advises monitoring after the restart. Keep an eye on the advisory for updated guidance.