Renew the Exchange hybrid certificate without breaking mail

In an Exchange hybrid deployment, the public certificate does two jobs: it secures Outlook, OWA and ActiveSync, and it authenticates mail between your servers and Exchange Online. The connectors on both sides name that certificate. Replace it carelessly and mail between on-premises and Exchange Online stops, often only in one direction.

This runbook applies to Exchange Server Subscription Edition (SE) and Exchange 2019. Exchange 2016 and 2019 reached end of support on 14 October 2025, and the paid extended security updates ended in October 2026; plan the move to SE or Exchange Online.

Before you start

Back up the connector settings so you can compare and roll back:

Get-SendConnector | Export-Clixml C:\backup\send-connectors.xml
Get-ReceiveConnector | Export-Clixml C:\backup\receive-connectors.xml

And in Exchange Online PowerShell, the same for Get-InboundConnector and Get-OutboundConnector.

1. Import the certificate on every server

Import the .pfx on each Exchange server, with an exportable key so it can be moved between servers:

Import-ExchangeCertificate -Server EX01 -FileData ([System.IO.File]::ReadAllBytes('\\fs01\certs\mail.pfx')) -Password (Get-Credential).Password -PrivateKeyExportable $true

(-FileName was removed in 2022; use -FileData.) On Exchange 2019 CU15 and SE you can also do this in the Exchange admin center under Servers > Certificates.

Make sure the intermediate certificate is installed too:

Get-ChildItem Cert:\LocalMachine\My\<thumbprint> | Test-Certificate | Format-List

Exchange picks the hybrid certificate by issuer and subject, and uses the matching certificate with the latest expiry date. So once the new one is imported, it is effectively live for the connectors. Import it when you're ready to finish the change.

2. Enable it for IIS and SMTP

Enable-ExchangeCertificate -Server EX01 -Thumbprint <new-thumbprint> -Services IIS,SMTP

When asked whether to overwrite the default SMTP certificate, answer No. The default self-signed certificate is used for internal transport and Edge synchronisation; replacing it breaks EdgeSync and means repeating work at every renewal.

Changing certificates can remove the binding from the Default Web Site or Exchange Back End site in IIS. Check both afterwards, and run iisreset if clients still see the old certificate.

3. Update the hybrid connectors

The recommended way is to run the Hybrid Configuration Wizard again and choose Update Secure Mail Certificate for Connectors. It updates:

the on-premises Send connector to Office 365 (TlsCertificateName);
the Default Frontend Receive connector on each hybrid server (TlsCertificateName);
the Exchange Online Inbound connector (TlsSenderCertificateName);
the Exchange Online Outbound connector (TlsDomain).

To do it by hand on-premises:

$c = Get-ExchangeCertificate -Thumbprint <new-thumbprint>
$name = "<I>$($c.Issuer)<S>$($c.Subject)"
Set-SendConnector "Outbound to Office 365 - <GUID>" -TlsCertificateName $name
Set-ReceiveConnector "EX01\Default Frontend EX01" -TlsCertificateName $name

Repeat the Receive connector change on every hybrid server. In Exchange Online, TlsSenderCertificateName on the Inbound connector and TlsDomain on the Outbound connector must match a name in the certificate.

4. Check mail flow both ways

Get-ExchangeCertificate | Format-List FriendlyName,Subject,Thumbprint,Services,NotAfter
Send a test message from an on-premises mailbox to a cloud mailbox and back.

Check that SMTP offers the new certificate:

openssl s_client -connect mail.example.com:25 -starttls smtp -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -enddate -subject

Microsoft's CSS-Exchange HealthChecker script also checks the hybrid certificate configuration.

5. Remove the old certificate, last

Only after the connectors use the new certificate and mail flows:

Remove-ExchangeCertificate -Server EX01 -Thumbprint <old-thumbprint>

Removing it while a Receive connector still refers to it stops STARTTLS, and mail from Exchange Online with it.

Errors and what they mean

Error	Direction	Usual cause
`450 4.4.317 … SubjectMismatch`	Exchange Online → on-premises	Receive connector certificate doesn't match the Outbound connector's `TlsDomain`
`451 5.7.3 STARTTLS is required`	Exchange Online → on-premises	Missing chain or wrong certificate name
`454 4.7.5 … TlsCertificateName … could not be found`	On-premises → Exchange Online	Send connector names a certificate that isn't installed
`550 5.7.51 TenantInboundAttribution`	On-premises → Exchange Online	Certificate doesn't match the Inbound connector's `TlsSenderCertificateName`

The other certificate: Exchange Server Auth Certificate

Hybrid features such as free/busy use OAuth, signed by a separate self-signed Microsoft Exchange Server Auth Certificate. It has its own expiry date and isn't renewed with the public certificate. Check it:

(Get-AuthConfig).CurrentCertificateThumbprint | Get-ExchangeCertificate | Format-List Subject,Thumbprint,NotAfter

Microsoft's MonitorExchangeAuthCertificate script can renew it. After a change, allow at least 48 hours for it to take effect, and re-run the Hybrid Configuration Wizard.

Check your domain

The free scan checks the certificate your mail server presents and flags it when a renewed certificate exists but isn't installed yet. See also Certificate renewed but not installed.

Renew the Exchange Server certificate in a hybrid setup without breaking mail flow