Wrong SMTP certificate on Exchange Server 2016

Davide Zampatori 1 Reputation point
2020-07-27T13:40:59.35+00:00

Hello,

I've installed a brand new exchange 2016 server and my company is running on it straight and clean from a month or so, but last week a user asked me why the SMPT certificate gives an error. Looking at the error, the certificate that the user get is the built-in SMTP certificate of the installation and not the one from the public CA.

I've reassigned the SMTP service via EAC and on ECP, nothing works.

The question is... there is some way to unassign SMTP service to built-in certficate?

Many Thanks

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,355 questions

9 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Davide Zampatori 1 Reputation point
    2020-07-30T13:45:24.523+00:00

    Hi I've tryed to delete the certificate by backupping the VM that runs Exchange.
    Deleting it cause the server to go nuts... nothing work and even if I assign the SMTP service to the public certificate the service still expect the built-in certificate.

    The user is using Thunderbird configured in IMAP.
    When looking for the STARTTLS certificte used is the built-in: I get CN="SERVERNAME" and not the public one.
    I've tryed enabling both via EAC and ECP.

    There is no more breaking down... Simply the server keep using the built-in even if I've associated the SMTP service with the correct certificate.

    0 comments
  2. Andy David - MVP 142.2K Reputation points MVP
    2020-07-30T15:17:41.323+00:00

    Yikes. Ok, as I mentioned, do not delete that certificate.
    Can you list all the Exchange Certificates with Get-ExchangeCertificate |FL ?
    Remove any personal information

    What is set for the FQDN on the "Client Frontend <ServerName>" receive connector? That should match a subject name on the certificate enabled for SMTP
    The IMAP clients should be using port 587 to submit messages and they use that connector

  3. Lucas Liu-MSFT 6,161 Reputation points
    2020-08-03T09:47:44.64+00:00

    Hi,
    If exporting the certificate causes the server to fail, please run the following command line to create a new self-signed certificate.
    New-ExchangeCertificate -FriendlyName Microsoft Exchange -SubjectName <> -DomainName <> -Services <>
    For more information:Create a new Exchange Server self-signed certificate
    What is the error given by the SMTP certificate?

  4. Lucas Liu-MSFT 6,161 Reputation points
    2020-08-04T09:10:18.52+00:00

    Hi,
    Please follow the steps below to bind the specific certificate to the receive connector and see if the issue is resolved.

    1. Please run the following command to get information of your certificate:
      Get-ExchangeCertificate
    2. Please run the following command to Capture the certificate as a variable.
      $cert = Get-ExchangeCertificate -Thumbprint <>
    3. In order to configure the certificate on the receive connector, please run the following command to create a special string that contains the issuer and the subject of the certificate:
      $tlscertificatename = "<i>$($cert.Issuer)<s>$($cert.Subject)"
    4. Please run the following command to configure the receive connector:
      Set-ReceiveConnector "<>" -TlsCertificateName $tlscertificatename
      For more information you could refer to: Configuring the TLS Certificate Name for Exchange Server Receive Connectors and Configuring a Certificate on Exchange Receive Connector
      Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.