Renewing the Exchange hybrid certificate without breaking mail flow

The public certificate on your hybrid servers is what lets Exchange Online trust mail from on-premises and vice versa. Renew it carelessly and mail between the two sides queues up, or quietly starts using a certificate you didn't intend. In this post I'll walk through a renewal runbook that keeps hybrid mail flowing, based on Microsoft's documented process, with the checks I'd run at each step.

Prerequisites#

• A renewed certificate from a trusted public certification authority, with its private key and the full chain (root and intermediate) available. Keep the same names (Subject and SAN) as the current one if you can; a change of names means connector changes in Exchange Online too.
• The list of servers that carry hybrid mail: every server selected for the hybrid send and receive connectors, plus any Edge Transport servers.
• Organization Management rights on-premises, Exchange Online PowerShell, the latest Hybrid Configuration Wizard (HCW) from https://aka.ms/hybridwizard, and a change window.
• Exchange Server Subscription Edition (SE). Exchange 2016 and 2019 reached end of support on 14 October 2025.

Step-by-step#

1. Record the current configuration#

Connectors don't store a thumbprint. They store TlsCertificateName in the format <I>issuer<S>subject, and Exchange picks the matching certificate at run time. Capture both sides before you touch anything:

# Exchange Management Shell
Get-HybridConfiguration | Format-List SendingTransportServers, ReceivingTransportServers, EdgeTransportServers, TlsCertificateName
Get-SendConnector "Outbound to Office 365*" | Format-List Name, TlsCertificateName
Get-ReceiveConnector "EX01\Default Frontend EX01" | Format-List Name, TlsCertificateName, TlsDomainCapabilities
Get-ExchangeCertificate -Server EX01 | Format-List Thumbprint, Subject, Issuer, CertificateDomains, Services, NotAfter

# Exchange Online PowerShell
Get-InboundConnector | Where-Object ConnectorType -eq 'OnPremises' | Format-List Name, TlsSenderCertificateName
Get-OutboundConnector | Where-Object ConnectorType -eq 'OnPremises' | Format-List Name, TlsDomain

Exchange Online receives mail into the Default Frontend receive connector unless you built a custom one; check it on every receiving server.

2. Get the renewed certificate onto every server#

Generate the request on an Exchange server with the private key marked exportable (New-ExchangeCertificate -GenerateRequest with -PrivateKeyExportable $true), and complete the pending request on the same server with Import-ExchangeCertificate. Then copy the certificate to the other hybrid servers:

# On the server that completed the request
$pfx = Export-ExchangeCertificate -Thumbprint <NewThumbprint> -BinaryEncoded -Password (Read-Host "PFX password" -AsSecureString)
[System.IO.File]::WriteAllBytes('C:\Certs\hybrid-renewed.pfx', $pfx.FileData)

# For each other hybrid server
Import-ExchangeCertificate -Server EX02 -FileData ([System.IO.File]::ReadAllBytes('C:\Certs\hybrid-renewed.pfx')) `
  -Password (Read-Host "PFX password" -AsSecureString) -PrivateKeyExportable $true

3. Enable it for SMTP#

Enable-ExchangeCertificate -Server EX02 -Thumbprint <NewThumbprint> -Services SMTP

Exchange asks whether to overwrite the default SMTP certificate. Answer No to keep the self-signed certificate for internal communication between transport services and with Edge servers. If the same certificate also publishes EWS and Autodiscover, add IIS to -Services, and update any load balancer or reverse proxy that terminates TLS; free/busy and mailbox moves from Exchange Online depend on it.

4. Update the hybrid connectors#

Compare the new certificate's issuer and subject with the old one:

• Same issuer and subject: there's usually nothing to change; TlsCertificateName already matches the new certificate. If you set it anyway, the warning "The command completed successfully but no settings have been modified" confirms this.
• Different issuer or subject (CAs often move renewals to a new intermediate): run the HCW again and select the new certificate when it asks for the transport certificate. The wizard updates the on-premises connectors, the Exchange Online connectors and the stored HybridConfiguration object together.

If you can't run the wizard, update the on-premises connectors by hand:

$cert = Get-ExchangeCertificate -Server EX01 -Thumbprint <NewThumbprint>
$tls  = "<I>$($cert.Issuer)<S>$($cert.Subject)"
Set-SendConnector -Identity "Outbound to Office 365 - <GUID>" -TlsCertificateName $tls
Set-ReceiveConnector -Identity "EX01\Default Frontend EX01" -TlsCertificateName $tls   # repeat per receiving server

If the certificate's names changed, also update TlsSenderCertificateName with Set-InboundConnector and TlsDomain with Set-OutboundConnector in Exchange Online. This is where the HCW saves you mistakes.

5. Restart transport and handle Edge servers#

Restart the transport service on each hybrid server so it picks up the change: Restart-Service MSExchangeTransport. If Edge Transport servers carry hybrid mail, install and enable the certificate on each Edge server (again answering No to the default SMTP prompt), then set the Edge receive connector's TlsDomainCapabilities and Fqdn as described in Microsoft's Edge hybrid guidance.

Verify#

1. Every hybrid server holds the new certificate with a private key and SMTP enabled:
   PowerShell

   Get-ExchangeCertificate -Server EX02 -Thumbprint <NewThumbprint> | Format-List Services, HasPrivateKey, NotAfter, Status

2. Nothing is stuck in the hybrid queue on any sending server: Get-Queue -Server EX01 | Where-Object LastError | Format-List Identity, NextHopDomain, LastError returns nothing for contoso.mail.onmicrosoft.com.
3. The protocol log shows the new thumbprint. Turn on verbose logging for the send connector if it's off, send a test message, then search the log folder:
   PowerShell

   Set-SendConnector "Outbound to Office 365 - <GUID>" -ProtocolLoggingLevel Verbose
   $path = (Get-TransportService EX01).SendProtocolLogPath
   Select-String -Path "$path\*.log" -Pattern 'thumbprint' | Select-Object -Last 3

4. Test messages flow both ways, and the headers show X-MS-Exchange-Organization-AuthAs: Internal; see my hybrid mail flow deep dive for what to compare.
5. Only after all of that, remove the old certificate from each server with Remove-ExchangeCertificate.

Tips and gotchas#

• A queue error like 454 4.7.5 The certificate specified in TlsCertificateName of the SendConnector could not be found means the connector's issuer/subject string matches no valid certificate on that server.
• Don't import the renewed certificate weeks early "to be ready" if issuer and subject are unchanged; Exchange may start using it straight away.
• An incomplete chain on one server gives intermittent failures that depend on which server handles the connection; install the intermediates everywhere.
• Put the expiry date in your calendar with at least a month's notice, and treat the Auth Certificate as a separate item.

References#

• Renew TLS certificates in an Exchange Hybrid deployment (Microsoft Learn)
• Transport options in Exchange hybrid deployments (Microsoft Learn)
• Hybrid Configuration wizard (Microsoft Learn)