# Renew the Exchange Server certificate in a hybrid setup without breaking mail flow

In an Exchange hybrid deployment, the public certificate does two jobs: it
secures Outlook, OWA and ActiveSync, and it authenticates mail between your
servers and Exchange Online. The connectors on both sides name that
certificate. Replace it carelessly and mail between on-premises and Exchange
Online stops, often only in one direction.

This runbook applies to Exchange Server Subscription Edition (SE) and Exchange
2019. Exchange 2016 and 2019 reached end of support on 14 October 2025, and
the paid extended security updates ended in October 2026; plan the move to SE
or Exchange Online.

## Before you start

Back up the connector settings so you can compare and roll back:

```
Get-SendConnector | Export-Clixml C:\backup\send-connectors.xml
Get-ReceiveConnector | Export-Clixml C:\backup\receive-connectors.xml
```

And in Exchange Online PowerShell, the same for `Get-InboundConnector` and
`Get-OutboundConnector`.

## 1. Import the certificate on every server

Import the `.pfx` on **each** Exchange server, with an exportable key so it
can be moved between servers:

```
Import-ExchangeCertificate -Server EX01 -FileData ([System.IO.File]::ReadAllBytes('\\fs01\certs\mail.pfx')) -Password (Get-Credential).Password -PrivateKeyExportable $true
```

(`-FileName` was removed in 2022; use `-FileData`.) On Exchange 2019 CU15 and
SE you can also do this in the Exchange admin center under **Servers >
Certificates**.

Make sure the intermediate certificate is installed too:

```
Get-ChildItem Cert:\LocalMachine\My\<thumbprint> | Test-Certificate | Format-List
```

Exchange picks the hybrid certificate by issuer and subject, and uses the
matching certificate with the latest expiry date. So once the new one is
imported, it is effectively live for the connectors. Import it when you're
ready to finish the change.

## 2. Enable it for IIS and SMTP

```
Enable-ExchangeCertificate -Server EX01 -Thumbprint <new-thumbprint> -Services IIS,SMTP
```

When asked whether to **overwrite the default SMTP certificate**, answer
**No**. The default self-signed certificate is used for internal transport
and Edge synchronisation; replacing it breaks EdgeSync and means repeating
work at every renewal.

Changing certificates can remove the binding from the **Default Web Site** or
**Exchange Back End** site in IIS. Check both afterwards, and run `iisreset`
if clients still see the old certificate.

## 3. Update the hybrid connectors

The recommended way is to run the **Hybrid Configuration Wizard** again and
choose **Update Secure Mail Certificate for Connectors**. It updates:

- the on-premises **Send connector** to Office 365 (`TlsCertificateName`);
- the **Default Frontend** Receive connector on each hybrid server
  (`TlsCertificateName`);
- the Exchange Online **Inbound connector** (`TlsSenderCertificateName`);
- the Exchange Online **Outbound connector** (`TlsDomain`).

To do it by hand on-premises:

```
$c = Get-ExchangeCertificate -Thumbprint <new-thumbprint>
$name = "<I>$($c.Issuer)<S>$($c.Subject)"
Set-SendConnector "Outbound to Office 365 - <GUID>" -TlsCertificateName $name
Set-ReceiveConnector "EX01\Default Frontend EX01" -TlsCertificateName $name
```

Repeat the Receive connector change on every hybrid server. In Exchange
Online, `TlsSenderCertificateName` on the Inbound connector and `TlsDomain` on
the Outbound connector must match a name in the certificate.

## 4. Check mail flow both ways

- `Get-ExchangeCertificate | Format-List FriendlyName,Subject,Thumbprint,Services,NotAfter`
- Send a test message from an on-premises mailbox to a cloud mailbox and back.
- Check that SMTP offers the new certificate:

  ```
  openssl s_client -connect mail.example.com:25 -starttls smtp -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -enddate -subject
  ```

- Microsoft's CSS-Exchange **HealthChecker** script also checks the hybrid
  certificate configuration.

## 5. Remove the old certificate, last

Only after the connectors use the new certificate and mail flows:

```
Remove-ExchangeCertificate -Server EX01 -Thumbprint <old-thumbprint>
```

Removing it while a Receive connector still refers to it stops STARTTLS, and
mail from Exchange Online with it.

## Errors and what they mean

| Error | Direction | Usual cause |
|---|---|---|
| `450 4.4.317 … SubjectMismatch` | Exchange Online → on-premises | Receive connector certificate doesn't match the Outbound connector's `TlsDomain` |
| `451 5.7.3 STARTTLS is required` | Exchange Online → on-premises | Missing chain or wrong certificate name |
| `454 4.7.5 … TlsCertificateName … could not be found` | On-premises → Exchange Online | Send connector names a certificate that isn't installed |
| `550 5.7.51 TenantInboundAttribution` | On-premises → Exchange Online | Certificate doesn't match the Inbound connector's `TlsSenderCertificateName` |

## The other certificate: Exchange Server Auth Certificate

Hybrid features such as free/busy use OAuth, signed by a separate self-signed
**Microsoft Exchange Server Auth Certificate**. It has its own expiry date and
isn't renewed with the public certificate. Check it:

```
(Get-AuthConfig).CurrentCertificateThumbprint | Get-ExchangeCertificate | Format-List Subject,Thumbprint,NotAfter
```

Microsoft's MonitorExchangeAuthCertificate script can renew it. After a
change, allow at least 48 hours for it to take effect, and re-run the Hybrid
Configuration Wizard.

## Check your domain

The free scan checks the certificate your mail server presents and flags it
when a renewed certificate exists but isn't installed yet. See also
[Certificate renewed but not installed](/guides/certificate-renewed-but-not-installed).

## Sources

- [Microsoft: TLS certificates in Exchange hybrid, common issues and fixes (June 2025)](https://techcommunity.microsoft.com/blog/exchange/tls-certificates-in-exchange-hybrid---common-issues--how-to-fix-them/4420592)
- [Microsoft: mail not received after installing a new certificate](https://learn.microsoft.com/en-us/exchange/troubleshoot/email-delivery/cannot-receive-mail-with-new-certificate)
- [Microsoft: renew an Exchange Server certificate](https://learn.microsoft.com/en-us/exchange/architecture/client-access/renew-certificates)
- [Microsoft: Import-ExchangeCertificate](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/import-exchangecertificate)
- [Microsoft: Enable-ExchangeCertificate](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/enable-exchangecertificate)
- [Microsoft: Set-SendConnector](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-sendconnector)
- [Microsoft: maintain the Exchange Server Auth Certificate](https://learn.microsoft.com/en-us/exchange/plan-and-deploy/integration-with-sharepoint-and-skype/maintain-oauth-certificate)
- [Microsoft: support for Exchange 2016 and 2019 ends](https://techcommunity.microsoft.com/blog/exchange/support-for-exchange-server-2016-and-exchange-server-2019-ends-today/4461192)

---
Source: https://nameward.app/guides/exchange-hybrid-certificate-renewal (updated 2026-10-29)