Renew expired exchange delegation federation certificate

Question

Hi Support,

We have 2 x exchange 2013 Hybrid servers in root domain and around 12 x exchange 2016 MBX servers in root and subdomain. Since EX2013 will end of life, we planned to migrate the Hybrid server to EX2016.

Each exchange servers have a “delegation federation certificate”, some of them valid and some of them expired. When we run the hybrid wizard in new EX2016 Hybrid server, will all of these certificate renew?
Or we need to remove the federation domain from the trust to renew the certificate as this documents: Renew the federation certificate: Exchange 2013 Help | Microsoft Learn ?
Any impact if we remove the domain from the trust?

Thanks
Chong

Answer 1

@Chong

If this certificate expired, you will get error about free/busy, so you need to renew this certificate if it expired.

In your organization, if the exchange delegation federation certificate on root Exchange 2016 isn't expired, you could try to run HCW to switch hybrid server from Exchange 2013 to Exchange 2016 first. If you cannot run HCW, then try to renew all expired certificate. Even if you can run HCW successfully, you may still encounter problems about free/busy afterwards.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

I would recreate the Federation Cert manually before you run the Hybrid Wizard - otherwise it will fail:
https://techcommunity.microsoft.com/t5/exchange-team-blog/how-to-address-federation-trust-issues-in-hybrid-configuration/ba-p/1144285

You can recreate an expire cert following this doc:

https://learn.microsoft.com/en-us/previous-versions/exchange-server/exchange-160/mt779252(v=exchg.160)?redirectedfrom=MSDN#replace-an-expired-federation-certificate

Answer 3

Hi @Andy David - MVP ,

So we should follow the link to recreate the trust first before run the hybrid wizard.

We have more than 10 subdomain and the federation certificate in those domain Exchange servers were expired (only the root domain and 1 subdomain Exchange is renew and valid, I don't know why), what is the impact of those domain if remove the domain trust?

Best Regards
Chong

Answer 4

Hi @KyleXu-MSFT and @Andy David - MVP ,

Before I renew the federation cert and re-run the HCW, I found the subdomain user still work on the free/busy between on-premise Exchange and Exchange Online, even the subdomain exchange server's federation certificate is invalid (the certificate of hybrid server in root domain is valid).

Why the free/busy work in our environment?
As our user account located on subdomain exchange database but the email address is using root domain, do this setting cause the federation still valid so the free/busy work?

Do I still need to remove the federation domain trust to renew the federation certificate for those subdomain exchange?

Thanks

Best Regards
Chong