Renew TLS certificates in an Exchange Hybrid deployment

Summary

In an Exchange Hybrid deployment, Transport Layer Security (TLS) certificates securely share information between users in Exchange on-premises and Exchange Online. This secure sharing includes mail flow, free/busy sharing, and other features. While a self-signed certificate is enough for internal mail flow between servers in an on-premises organization, when you configure a hybrid deployment, you must use and configure certificates that you purchase from a trusted third-party CA for hybrid mail flow - Certificate requirements for hybrid deployments.

If you renew an Exchange certificate without updating the associated hybrid configuration, you can disrupt secure communication between Exchange Online and Exchange on-premises. This disruption results in hybrid mail flow failures and other hybrid feature issues.

This article describes how to safely renew a certificate in an Exchange hybrid environment without affecting the rich hybrid services like secure mail flow, availability, and more.

The following diagram shows the major steps involved in the process:

Screenshot of Exchange hybrid certificate renewal workflow with decision point for subject/issuer changes.

Important considerations when renewing Exchange Certificate

  • Hybrid mail flow depends on connectors and their TLS configuration.

  • When you renew certificates, connectors might still reference the previous certificate, which can disrupt mail flow.

Step 1: Identify current certificate used for hybrid mailflow

Send and Receive Connector don't store the thumbprint of the certificate. Connectors use the TLSCertificateName parameter to choose the certificate for Hybrid mail flow. Set this parameter in the format: <I>Issuer<S>SubjectName, where the values correspond to the issuer and subject name of the third-party CA certificate.

Check Send and Receive Connector’s TLScertificatename parameter

Get-SendConnector "Outbound to Office 365*" | fl Name,TlsCertificateName

Get-ReceiveConnector "Server\ Default Frontend Server" | fl Name,TlsCertificateName

Note

By default, Exchange Server on-premises receives emails from Exchange Online through the Default Frontend Receive connector. Enter the name of this connector unless your environment uses a custom Receive connector to accept mail from your Exchange Online tenant.

Verify if the certificate you plan to renew is used by current Hybrid Mailflow

Copy the subject name derived from the preceding step and run the following command (the example uses contoso as the subject name in the command)-

Get-ExchangeCertificate | where {$_.Subject -like "*contoso*"} | fl Thumbprint,Subject,Services

If the output matches the certificate you plan to renew, the certificate is currently used for hybrid mailflow. If there are multiple trusted 3rd-party certificates with the same subject name and issuer name, Exchange server usually uses the one that's valid (non-expired) and has the most recent Valid from date.

If you're still not sure, you can Analyze Exchange Server protocol logs which clearly shows the certificate with thumbprint used by the connectors.

Step 2: Verify certificate requirements and install it

Ensure the new certificate:

  • Is issued by a trusted third-party certificate authority

  • Has a valid certificate chain with root and intermediate certificates installed

  • The certificate has an associated private key.

Use the steps here to generate a new certificate request and get the certificate issued by your certificate provider. When generating the Certificate Signing Request (CSR), set PrivateKeyExportable to TRUE and submit the request to the third-party certificate provider.

After you receive the certificate from the provider, follow the steps to complete the pending Exchange Server certificate request. If more than one server is involved in routing email with Exchange Online, make sure you export the certificate from Exchange server and import or install the certificate on all other Exchange servers.

To learn about important considerations when renewing Exchange certificates, see TLS Certificates in Exchange Hybrid - Common Issues & How to Fix them.

Step 3: Assign the renewed certificate to SMTP

Enable the SMTP service on the new certificate. You can do this from EAC by following assign certificates to Exchange Server services. Or run the following command from ```powershell

Enable-ExchangeCertificate -Thumbprint <NewCertificateThumbprint> -Services SMTP

When you assign the SMTP service to a renewed certificate, Exchange prompts you to overwrite the existing certificate set for transport services. Select No if you want to use the existing self-signed certificate for internal communication with other Transport Services and Edge server (if any). Continue using the self-signed certificate for internal transport communication because of higher validity.

Step 4: Update hybrid connectors with new certificate

If the old and renewed certificate use the same subject and issuer name, you usually don't need to do anything. Exchange matches the new certificate with the existing TlsCertificateName parameter and automatically uses the new certificate based on the latest Valid from date. However, if they're different, run the Hybrid Configuration wizard (HCW) again and select the new certificate for hybrid mailflow. HCW automatically updates the required parameters.

If you don't want to run HCW, you can manually update the certificate configuration on connectors by using the following PowerShell commands:

$cert = Get-ExchangeCertificate -Thumbprint "<new certificate thumbprint>"

$TLSCertificateName = "<i>$($Cert.Issuer)<s>$($Cert.Subject)"

Set-ReceiveConnector -Identity "Receive Connector Identity" -TlsCertificateName $TLSCertificateName

Set-SendConnector -Identity “"Outbound to Office 365*" -TlsCertificateName $TLSCertificateName

Step 5: Restart transport services

Restart Exchange transport services to apply changes.

PowerShell

Restart-Service MSExchangeTransport

Step 6: Edge Transport considerations (if applicable)

If your environment includes Edge Transport servers:

  • Install the new certificate on the Edge server and enable it for SMTP Service.

When you assign the SMTP service to a renewed certificate, Exchange prompts you to overwrite the existing certificate set for transport services. Select No if you want to use the existing self-signed certificate for internal communication with other Transport Services and Edge server (if any).

  • Using Exchange Management Shell on the Edge server, manually set the TlsDomainCapabilities and Fqdn parameters of the Receive connector of the Edge server. Follow the procedure mentioned at Edge Transport servers with hybrid deployments.

Step 7: Validate configuration

Verify Send Connector configuration

PowerShell

Get-SendConnector "Outbound to Office 365" | fl TlsCertificateName

Make sure the TlsCertificateName has the current certificate’s issuer name and subject name in the format: <I>Issuer<S>SubjectName

Send test email from Exchange On-Premises to Exchange online and check Exchange Server protocol logs to know which certificate with thumbprint is used by the connector.

Confirm mail flow

  • Send test messages from:

    • On-premises → Exchange Online

    • Exchange Online → On-premises

Common issues and best practices

Based on field experience and Exchange Team guidance:

  • Always update connectors after certificate renewal to avoid mail flow disruption [techcommun...rosoft.com].

  • Avoid importing certificates too early - Exchange might select the newest certificate unexpectedly.

  • Maintain complete certificate chain (root + intermediate).

  • Use HCW for consistent configuration updates across environments.

Additional resources