Outbound Mail Connector and Certificate Issue

Question

Please review this article for reference: Configure Outbound Mail via Office 365. Based on the guidance (https://www.alitajran.com/configure-outbound-mail-office-365/), I created a new connector to route outbound internet mail through Office 365 EOP with the following configuration in hybrid:

Code

New-SendConnector -Name "Outbound to Internet via Office 365" `

-AddressSpaces * `

-CloudServicesMailEnabled $true `

-Fqdn given name `

-RequireTLS $true `

-DNSRoutingEnabled $false `

-SmartHosts given as per guidance

-TLSAuthLevel CertificateValidation

Test Mail Flow Result:

Outbound mail routed through the connector Outbound to Internet via Office 365 failed due to certificate trust problems.

Our Exchange server is currently using a certificate private for SMTP.

Error observed: 550 5.7.64 Relay Access Denied

Full certificate chain to a Microsoft‑trusted Root CA was not found.

Certificate Details:

A wildcard certificate is valid until June 2026. It is currently used for SSL but not enabled for SMTP.

This wildcard certificate looks good, and it may be possible to use the same certificate for outbound mail if we enable it for SMTP.

The certificate currently bound to SMTP, IIS, POP, and IMAP is a self‑signed certificate generated automatically during installation.

Question:

Can we enable the wildcard certificate for SMTP and use it for outbound mail, or do we need to request a new public certificate issued by a trusted CA?