TLS Certificate

Question

Hi All

I am using exchange 2016 hybrid environment. lets say my domain is contoso.com and i am using wild certificate *.contoso.com which has expired. i went to certificates and added the new wildcard certificate and noted the thumbprint. i followed the below steps but how do i validate tls certificate is renewed for these connectors
Default Frontend server01, Client Frontend server01, Anonymous Relay server01, Inbound Office 365

Get-SendConnector |fl name,TlsCertificateName
Get-TransportService server01 | Get-ReceiveConnector | fl name,tls*

$c = Get-ExchangeCertificate -Server server01 -Thumbprint 1111111111111111111111111111111111
$tcert = "<i>$($c.Issuer)<s>$($c.Subject)"
$tcert


Get-ReceiveConnector "server01\Default Frontend server01" | Set-ReceiveConnector -TlsCertificateName $tcert
Get-ReceiveConnector "server01\Client Frontend server01" | Set-ReceiveConnector -TlsCertificateName $tcert
Get-ReceiveConnector "server01\Anonymous Relay server01" | Set-ReceiveConnector -TlsCertificateName $tcert
Get-ReceiveConnector "server01\Inbound Office 365" | Set-ReceiveConnector -TlsCertificateName $tcert

Answer 1

You mean, you want to make sure the connectors are using that new cert?

If so enable protocol logging on those connectors and check the text logs created after you enable it. It will show what cert is being used. You can search for the new thumbprint

https://learn.microsoft.com/en-us/exchange/mail-flow/connectors/configure-protocol-logging?view=exchserver-2019#use-the-eac-to-configure-protocol-logging