This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 61%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBM%3C/text%3E%3C/svg%3E)
Good morning dear colleagues, I have a problem sending mail from Ex2019 to Exchange Online, it remains queued on my server and does not go to the output connector that was created in the wizard, the related error in the queues is the following
454 4.7.5 Certificate validation failure, reason:untrustedroot};{MSG=};{FQDN=*-mail-onmicrosoft-com.mail.protection.outlook.com.
I already verified the certificate and it is active and working, it is the same one that my connection has in my 365 administration.
In the information of the message in the queue I see that it is using the output connector but for some reason it cannot make the sending channel from Ex2019 to O365 and thus send it abroad; I have internal communication on both routes, input and output, that means that the connector works, but the external output of my Ex2019 remains stuck.
Thank you very much in advance for the help.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EYS%3C/text%3E%3C/svg%3E)
Hi @Benyamin Marcos Carranza ,
From the output of Get-SendConnector, do you mean "Outbound to Office365 xxxx" is the only one send connector on Exchange 2019? Did you manually edit the configuration of this connector after running HCW by adding all domains asterisks into the address spaces section?
If so, please try temporarily disabling this send connector, create a dedicated Internet send connector on Exchange server 2019 for all domains asterisks by following this article, then rerun HCW and check if the mail flow from Exchange 2019 to Office 365 or external recipients can work.
By the way, are you intended to send all outbound mails via Office 365? If so, you can then read through the steps in the blog below to create another send connector for it:
Configure outbound mail via Office 365
(Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.)
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi @Benyamin Marcos Carranza ,
Just checking in to see how things are going with this issue. Any update would be appreciated.
Hello Yuki, what a pity, sorry for prolonging the response, I had an accident while traveling on a motorcycle, now I carry out the tests and I was able to transfer the messages to EOP, I already have external mail flow to 365, thank you very much for all your time and support. In conclusion I ended up disabling the connector that the HWC wizard created for me, because having it active rejected my messages, I only left the connector that I created in the ExServ Shell to the internet using the mx-smarthost, I carried out successful tests towards my 365 accounts, premises and externals.
Hello Yuki, I apologize for prolonging the response, I had a motorcycle accident and I was suspended recovering my health, thank you very much for your time and support, let me tell you; I carried out the tests by creating the connector through the shell using the 365 MX as a smarthost and I already have mail flow from my premise to external in my 365 message tracking, now if I activate the connector that is created with the HWC this It rejects them, from what I understand, a loop is created, so I delete the connector, test sending my premise to 365 in both ways and they are satisfactory.
Greetings my dear and thank you very much, I will return to work with good news, thanks to the support you gave me.
Hi @Benyamin Marcos Carranza ,
454 4.7.5 Certificate validation failure, reason:untrustedroot};{MSG=};{FQDN=*-mail-onmicrosoft-com.mail.protection.outlook.com.
According to this error message, it could be related to the root certificates on the affected on-prem server. Please try to download the certificate chains via the link below and then install them on the Exchange 2019 server.
https://learn.microsoft.com/en-us/purview/encryption-office-365-certificate-chains
After that, restart the "Microsoft Exchange Transport" and the “Microsoft Exchange Frontend Transport” service, wait for a few minutes and check if it can fix the issue.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
It gave me this error, after installing the certificate:
LastError : [{LED=451 4.4.397 Error communicating with target host. -> 421 4.2.1 Unable to connect -> SocketError: Failed to connect. Winsock error code: 10051, Win32 error code: 10051};{MSG=};{FQDN=gmail.com};{IP=2a00:1450:4013:c16::1b};{LRT=2/22/2024 2:50:03 PM}]
In advance I tested the documentation that @Andy David - MVP shared in another Q&A which tests the connectors and they were all satisfactory, I also made the set for the connector to send and receive the hash of the certificate, in this one I had a problem, it was satisfactory but it was not done no modification to the connectors.I have reviewed the fingerprint, and it is the same as the certificate, this certificate is new and unique previously, we did not have public SSL, only the domain one, but now that we created this hybrid environment we acquired this service and we have a willcard for our domain. I read the documentation about the problem of certificate validation, and that is why I add that we do not have an expired certificate, in fact I checked the MMC, and we do not have a double certificate or an expired one.
Hello dear colleagues, blessed day.
I want to share the progress with you, yesterday I updated my premise to CU14, performed the checks that Microsoft mentions, and it was satisfactory! In reference to the error that my mail queue gives me (certificate validation), this coincides with that of the connector (I will upload a photo certifying what I tell you).
Following up on the tests, I made sends through the connector and it gave me the same result sending to Gmail, and an educational domain from the state university of my country, the surprise was when I sent an email to Outlook (hotmail.com), this one did. It left and arrived in my mailbox, but when I tracked the messages there is no record in my 365 console, the 365 connector appears in the email header making the sending, I hope this information helps solve the problem that I have in external shipments.
If necessary I can share my header, censoring private data, thank you very much for your time and support in advance.
If necessary I can share my header, censoring private data, thank you very much for your time and support in advance.
Any suggestions, i will appreciate.
Hi @Benyamin Marcos Carranza ,
Following up on the tests, I made sends through the connector and it gave me the same result sending to Gmail, and an educational domain from the state university of my country, the surprise was when I sent an email to Outlook (hotmail.com), this one did.
Sorry that initially I thought the issue only occurs to mails sent from your Exchange 2019 to the Exchange Online in your hybrid environment. According to these additional information you shared above, do you mean the issue is that all outbound mails sent from Exchange 2019 are stuck in queue with errors except those which are sent to hotmail.com accounts? Could you run the following command on the Exchange 2019 against a problematic mail and see if we can have any findings. You can share the output after sanitizing all personal information like email address or domain name.
Get-TransportService|Get-MessageTrackingLog -MessageSubject <MailSubject> -Start "MM/DD/YYYY HH:MM" -End "MM/DD/YYYY HH:MM" |select timestamp,EventID,Source,ConnectorID |sort-object Timestamp
Additionally, could you also run the command below and share the configurations of your send connects on Exchange 2019? Be sure to remove all sensitive information.
Get-SendConnector | fl
Hello, good morning, the first image is of the email test with message 123 that was only going to Gmail.
In the second image, I sent it to Gmail and Hotmail, to Hotmail if I received the message, but I still have it queued to Gmail.
The third image is the shipping connector information.
the fourth image is the mail queue, with errors
and the fifth image is the queued mailings.
Event ID 2022
this is when i send to from Local, to 365