Expired Microsoft exchange server auth certificate in hybrid setup

Question

Expired Microsoft exchange server auth certificate in hybrid setup

Filip Soogen 171

Hi ,

I have a customer who's Microsoft Exchange Server Auth Certificate is expired.
The procedure to renew is pretty straightforward : http://byronwright.blogspot.com/2018/05/expired-microsoft-exchange-server-auth.html
But my question is : do i need to change something on Office365/Exchange Online ?
i can read in the comments that you need to export this certificate and upload it to Azure.
Or is running the hybrid wizard again an option ?
Please advise ...

thanks!
Filip

Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2020-12-14T13:27:42.18+00:00

The Cert used for Hybrid is, yes. Thats not the same cert used for OAuth (Microsoft Exchange Server Auth Certificate), - the one you asked about originally.
The Hybrid Cert is a 3rd party cert, The Server Auth cert is self-signed
The hybrid cert is enabled for SMTP.

Accepted answer

3 additional answers

Your answer

Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2020-12-14T13:27:42.18+00:00

The Cert used for Hybrid is, yes. Thats not the same cert used for OAuth (Microsoft Exchange Server Auth Certificate), - the one you asked about originally.
The Hybrid Cert is a 3rd party cert, The Server Auth cert is self-signed
The hybrid cert is enabled for SMTP.

Answer 1

Check the inbound connector in 365.

https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-route-mail
https://learn.microsoft.com/en-us/exchange/transport-routing

By the way, it could also be the firewall or other issues as described here:
https://answers.microsoft.com/en-us/msoffice/forum/msoffice_o365admin-mso_exchon-mso_o365b/exchange-2013-hybrid-tls-issue/9ec2b92a-1314-4b40-9cd6-08cb591f8323
https://www.reddit.com/r/exchangeserver/comments/b3qfof/exchange_hybrid_and_send_connector_tls/
https://c7solutions.com/2013/11/cannot-send-emails-to-office-365-or-exchange-online-protection-using-tls

You will need to explore all the connector settings and these other issues.

You could also create a new one per that article above and test with that

Answer 2

Andy David - MVP 157.8K MVP Volunteer Moderator

I would re-run the Hybrid Wizard. Doing that should take care of things

Answer 3

KyleXu-MSFT 26,396

@Filip Soogen

Here are the detailed information about the function of this certificate:

So, the best practice is to re-run HCW after renewing this certificate.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Filip Soogen 171

what happens if mail flow is still going onprem and all mailboxes are in the cloud so all mails go through the connector to O365 and this certificate is expired ?

Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2020-12-14T12:20:21.907+00:00

Mail will still flow as long as long as the cert used for Hybrid is valid. Thats a different cert and usage that the Oauth Cert that is used for free/busy and other requirements.
Filip Soogen 171 Reputation points

2020-12-14T13:25:44.203+00:00

this means, the certificate that is assigned to the service SMTP ?
Filip Soogen 171 Reputation points

2020-12-14T13:34:29.44+00:00

Ok , the 3rd party cert is assigned to SMTP (also pointed & selected in the hybrid wizard) ==> *.customer.be
Still ,there is no mailflow from onprem TO O365. (connector customer.mail.onmicrosoft.com)
mailflow fromO365 to Onprem is ok.
The error message is: (retrieved from the send connector log file from onprem to O365) :
"Connector is configured to send mail only over TLS connections and remote doesn't support TLS"
scratching my head on this one for a couple of days ...
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2020-12-14T13:37:13.83+00:00

Is this a different issue than the original question?

Did you check the inbound connector on the 365 side? What are its settings? What happens of you re-run the Hybrid WizArd?
Filip Soogen 171 Reputation points

2020-12-14T13:44:29.707+00:00

the original issue is indeed an expired Microsoft Exchange Server Auth Certificate.
at that moment there was no mailflow in both directions and i was thinking that was the issue , the expired cert. (Customer cannot say how long it is not working)
Now i know , a colleague renewed the 3rd party wildcard cert as it was going to expire.
we re-ran the HCW and selected the new cert and then suddenly mail flow is going from O365 to onprem , but still no mailflow from onprem to O365 ...
I have no idea what else i can check
Filip Soogen 171 Reputation points

2020-12-14T20:25:09.45+00:00

argh , have read all those articles - i indeed can even send an email via telnet and then they are arriving...(as in post https://c7solutions.com/2013/11/cannot-send-emails-to-office-365-or-exchange-online-protection-using-tls)
IP is also not blacklisted.
even compared the connector with other working connectors from other setups - same settings.
That was the reason i asked my initial question , thought it had to do with the expired cert.
i will look again in these articles and check the FW ...
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2020-12-14T20:26:10.663+00:00

Ok consider creating a new connector as well
Filip Soogen 171 Reputation points

2020-12-14T20:39:12.183+00:00

i assume you are talking about the inbound connector on O365 ?
will look at this issue again tomorrow with a fresh head :-)
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2020-12-14T20:46:55.75+00:00

yes :)
its not working now anyway, so no harm if you recreate it and disable the current one. Just be sure to follow that doc on how to create one for hybrid
KyleXu-MSFT 26,396 Reputation points

2020-12-15T09:20:47.497+00:00

The certificate used for mail flow and server-to-server authentication are two different certificate which don't affect each other. If the Microsoft Exchange Server Auth Certificate renewed successfully, I would suggest you accept the first reply as an answer.

About the new question, I would suggest you open a new thread to discuss it, "one thread one topic" will facilitate other users to query and reference. About the mail flow issue, you can remove existing connectors, then rerun HCW to recreate those connectors.
KyleXu-MSFT 26,396 Reputation points

2020-12-16T07:36:36.94+00:00

@Filip Soogen

Any update about this thread now?
Filip Soogen 171 Reputation points

2020-12-16T07:52:37.363+00:00

I was checking this issue yesterday , all day ...
i was able to get outbound mail working to external domains by following this article
https://www.petenetlive.com/KB/Article/0001251

inbound mail from the connector was working since i re-ran the HCW
Still, no messages are flowing from onprem to O365
I am checking this doc now : https://blog.expta.com/2014/03/troubleshooting-tls-smtp-connections-to.html
when i start a telnet session , then i don't see the 250-STARTTLS command .
When i try this from a computer from my domain , i can see the STARTTLS command.
I have asked the customer to check the FW...
Filip Soogen 171 Reputation points

2020-12-17T10:33:53.003+00:00

case can be closed.
it was the firewall that was doing packet inspection and also blocking TLS ...
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2020-12-17T11:54:44.723+00:00

Ok I mentioned that earlier. Not sure why you marked the other answer as accepted though :)
Filip Soogen 171 Reputation points

2020-12-17T13:39:42.367+00:00

you are correct.
Changed it ;-)

Share via

Expired Microsoft exchange server auth certificate in hybrid setup

3 additional answers

Your answer