This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(252.8, 9%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMR%3C/text%3E%3C/svg%3E)
Hi, is there a Automatic certificate renewal (CA) feature in M365 Exchange? As we are currently doing manual CA cert renewal as of the moment for our generic mailboxes.
Hi @MARTINEZ Rommel ,
To better help you on your issues, would you like to share more information about your question?
Is this a hybrid deployment? And do you mean you wanna renew the certificate for your on-prem Exchange or using for hybrid?
Best regards,
Lou
Hi Lou,
This is a hybrid deployment. So how will the cert renewal be handled in hybrid deployement?
Hi @MARTINEZ Rommel ,
If you want to renew the on-prem server certificate, I think you'll need to do that manually.
Based on the certificate type, you may resubmit the cert request, and download the cert from your CA to complete the request.
This thread may be helpful: https://learn.microsoft.com/en-us/answers/questions/286568/exchange-certificate-renewal-in-hybrid-environment.html
Best regards,
Lou
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi Lou,
Once migrated to Exchange online, is there a feature that this cert renewal can be done 'automatically'?
Regards.
Hi @MARTINEZ Rommel ,
Unfortunately no, because you'll still need to submit the certificate request to the commercial CA and upload the approved certificate to your on-prem server.
But if you decommissioned the on-prem server, you'll not need the certificate.
Best regards,
Lou
Hi @MARTINEZ Rommel ,
Do the suggestions above help? If the issue has been resolved, please click “Accept as answer” to mark the helpful reply as an answer, this will make answer searching in the forum easier and be beneficial to other community members as well.
If you are still stuck in this issue, please feel free to post your questions.
Regards,
Lou
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi Lou,
So once the on-prem server has been decommissioned, and we totally migrated to Exchange online, we will not be doing 'manual' renewal of the CA certificate for our generic/shared mailboxes?
Main reason is we want to do-away with the 'manual' renewal of this CA cert renewal process in Exchange online.
Regards.
Hi @MARTINEZ Rommel ,
Yes, the certificate is for the on-prem to bind with some services. So when you decommission the on-prem server, you'll be free from the certificate.
But before you finished that, which means the mail flow still go through the on-prem server, you'll need the cert to keep the services working, such as IIS/SMTP.
Best regards,
Lou
Not sure what exactly you are referring to here. "Server" certificates is not something you manage/have access to in Exchange Online, and if you're talking about S/MIME and such, you're in charge of managing the certificates and renewal (nothing in M365 relates to this).