Exchange Hybrid Certificate

Question

Hi,

I have a question to be verified for the following scenario:

We've Root Domain (lan.contoso.com) and the external URL for emails is contoso.com with 4 Exchange server 2013 and child domain (lan2.contoso.com) which has one exchange server 2013 with another external URL (domain.com)

both domains contoso.com and domain.com is added to accepted domains.

since exchange 2013 is out of support we are planning to migrate all users mailbox to EXCH Online.

I'm confused a little bit about the prober configuration for the hybrid configuration wizard:

1. do we need to run the hybrid configuration wizard in both domain (root and child) ? or the root domain is enough?
2. Microsoft Entra connect will be installed at the root domain and will sync all users from root domain and child.
3. M365 Tenant will be verified for both public domains.
4. regarding the certification for the hybrid wizard do we need a new certificate so the two domains (contoso.com and domain.com) will be added since each exchange server use his own certificate?

Thanks,

Answer 1

1. You run it once for the entire AD forest. (There can be only one Exchange org in an AD forest)
2. That will work.
3. Correct
4. The cert should contain all the domains and be the same cert across all the servers:

https://learn.microsoft.com/en-us/exchange/certificate-requirements#certificate-requirements-for-a-hybrid-deployment