Exchange hybrid certificate renewal checklist

Before you start

• A renewed certificate from a trusted public certification authority, with its private key and the full chain (root and intermediate) available. Keep the same names (Subject and SAN) as the current one if you can; a change of names means connector changes in Exchange Online too.
• The list of servers that carry hybrid mail: every server selected for the hybrid send and receive connectors, plus any Edge Transport servers.
• Organization Management rights on-premises, Exchange Online PowerShell, the latest Hybrid Configuration Wizard (HCW) from https://aka.ms/hybridwizard, and a change window.
• Exchange Server Subscription Edition (SE). Exchange 2016 and 2019 reached end of support on 14 October 2025.

Note: This post covers the third-party transport certificate. The self-signed Microsoft Exchange Server Auth Certificate used for OAuth has its own renewal procedure; see my hybrid free/busy article for how a renewed Auth Certificate reaches the dedicated hybrid application.

Checklist

1. 1

   Record the current configuration

   Connectors don't store a thumbprint. They store TlsCertificateName in the format <I>issuer<S>subject, and Exchange picks the matching certificate at run time. Capture both sides before you touch anything:

   powershell

   # Exchange Management Shell
   Get-HybridConfiguration | Format-List SendingTransportServers, ReceivingTransportServers, EdgeTransportServers, TlsCertificateName
   Get-SendConnector "Outbound to Office 365*" | Format-List Name, TlsCertificateName
   Get-ReceiveConnector "EX01\Default Frontend EX01" | Format-List Name, TlsCertificateName, TlsDomainCapabilities
   Get-ExchangeCertificate -Server EX01 | Format-List Thumbprint, Subject, Issuer, CertificateDomains, Services, NotAfter
   
   # Exchange Online PowerShell
   Get-InboundConnector | Where-Object ConnectorType -eq 'OnPremises' | Format-List Name, TlsSenderCertificateName
   Get-OutboundConnector | Where-Object ConnectorType -eq 'OnPremises' | Format-List Name, TlsDomain

2. 2

   Get the renewed certificate onto every server

   Generate the request on an Exchange server with the private key marked exportable (New-ExchangeCertificate -GenerateRequest with -PrivateKeyExportable $true), and complete the pending request on the same server with Import-ExchangeCertificate. Then copy the certificate to the other hybrid servers:

   powershell

   # On the server that completed the request
   $pfx = Export-ExchangeCertificate -Thumbprint <NewThumbprint> -BinaryEncoded -Password (Read-Host "PFX password" -AsSecureString)
   [System.IO.File]::WriteAllBytes('C:\Certs\hybrid-renewed.pfx', $pfx.FileData)
   
   # For each other hybrid server
   Import-ExchangeCertificate -Server EX02 -FileData ([System.IO.File]::ReadAllBytes('C:\Certs\hybrid-renewed.pfx')) `
     -Password (Read-Host "PFX password" -AsSecureString) -PrivateKeyExportable $true

   Watch out: When several valid certificates share the same issuer and subject, Exchange usually uses the one with the most recent "valid from" date. If your renewed certificate keeps the same issuer and subject, importing it is the switchover, so do it in the change window, on all servers together, with the chain installed.

3. 3

   Enable it for SMTP

   powershell

   Enable-ExchangeCertificate -Server EX02 -Thumbprint <NewThumbprint> -Services SMTP

   Exchange asks whether to overwrite the default SMTP certificate. Answer No to keep the self-signed certificate for internal communication between transport services and with Edge servers.

4. 4

   Update the hybrid connectors

   Compare the new certificate's issuer and subject with the old one:

   • Same issuer and subject: there's usually nothing to change; TlsCertificateName already matches the new certificate. If you set it anyway, the warning "The command completed successfully but no settings have been modified" confirms this.
   • Different issuer or subject (CAs often move renewals to a new intermediate): run the HCW again and select the new certificate when it asks for the transport certificate. The wizard updates the on-premises connectors, the Exchange Online connectors and the stored HybridConfiguration object together.

   If you can't run the wizard, update the on-premises connectors by hand:

   powershell

   $cert = Get-ExchangeCertificate -Server EX01 -Thumbprint <NewThumbprint>
   $tls  = "<I>$($cert.Issuer)<S>$($cert.Subject)"
   Set-SendConnector -Identity "Outbound to Office 365 - <GUID>" -TlsCertificateName $tls
   Set-ReceiveConnector -Identity "EX01\Default Frontend EX01" -TlsCertificateName $tls   # repeat per receiving server

   Tip: If you have moved OAuth to the dedicated Exchange hybrid application, an HCW run that includes the OAuth step can undo its service principal clean-up. Check the steps in my HCW troubleshooting post after the run.

5. 5

   Restart transport and handle Edge servers

   Restart the transport service on each hybrid server so it picks up the change: Restart-Service MSExchangeTransport.

Verify

• Every hybrid server holds the new certificate with a private key and SMTP enabled:
  powershell

  Get-ExchangeCertificate -Server EX02 -Thumbprint <NewThumbprint> | Format-List Services, HasPrivateKey, NotAfter, Status

• Nothing is stuck in the hybrid queue on any sending server: Get-Queue -Server EX01 | Where-Object LastError | Format-List Identity, NextHopDomain, LastError returns nothing for contoso.mail.onmicrosoft.com.
• The protocol log shows the new thumbprint. Turn on verbose logging for the send connector if it's off, send a test message, then search the log folder:
  powershell

  Set-SendConnector "Outbound to Office 365 - <GUID>" -ProtocolLoggingLevel Verbose
  $path = (Get-TransportService EX01).SendProtocolLogPath
  Select-String -Path "$path\*.log" -Pattern 'thumbprint' | Select-Object -Last 3

• Test messages flow both ways, and the headers show X-MS-Exchange-Organization-AuthAs: Internal; see my hybrid mail flow deep dive for what to compare.
• Only after all of that, remove the old certificate from each server with Remove-ExchangeCertificate.

Tips & gotchas

• A queue error like 454 4.7.5 The certificate specified in TlsCertificateName of the SendConnector could not be found means the connector's issuer/subject string matches no valid certificate on that server.
• Don't import the renewed certificate weeks early "to be ready" if issuer and subject are unchanged; Exchange may start using it straight away.
• An incomplete chain on one server gives intermittent failures that depend on which server handles the connection; install the intermediates everywhere.
• Put the expiry date in your calendar with at least a month's notice, and treat the Auth Certificate as a separate item.