We recently had a client who had an issue after replacing their external certificate for their Exchange 2016 Hybrid. While they could send emails out, inbound emails were not reaching the individuals’ mailboxes in Office 365.
Upon researching the issue, I noticed the following error in their mail queues:
–> 454 4.7.5 The certificate specified in TlsCertificateName of the SendConnector could not be found.
Inside this queue were now hundreds of messages that had obviously reached the server, but had not been delivered to the individual mailboxes in Office 365.
I knew the new certificate was in place and had the correct services assigned to it. Since email was flowing outbound and I could see messages in the queue, mail was at least getting to the on-prem Exchange server. This, along with the error message led me to be positive the error was in the send connector to Office 365.
The Root of the Problem
When a new certificate is assigned services, if it sees another certificate that has the same services assigned, it will ask if you want to overwrite the old certificate’s thumbprint with the new one to provide these services. By selecting yes, this should tell the connector that you want to use this new certificate for the services. This doesn’t always happen. So what do you do?
To fix this Mailflow issue with Exchange Server is quite simple.
- Verify the intermediate certificates for your new certificate are placed in the proper containers
- Most likely, the send connector is not using the new certificate. This is not possible to see in the GUI.
- To fix, perform the following to update the TLSCertificateName attribute on the Office 365 SendConnector
$Cert = Get-ExchangeCertificate -Thumbprint <New Exchange Certificate>
$TLSCert = (‘<I>’+$cert.issuer+'<S>’+$cert.subject)
Set-SendConnector -Identity <Office 365 send Connector> -TLSCertificateName $TLSCert
This should resolve the issue. If you retry the queue it should change to active and mail should now flow into the individual mailboxes.
Myke Schwartz, Director of IT Operations
Thank you Mike. This saved me a lot of time on a Sunday afternoon 🙂
Life saver, thanks a lot!
Thank you very much. You saved my ass.
Thank you!
Thank you! Saved me from a minor stroke this morning.
Thank you so much for this! It saved me a long evening!
After many hours of investigation, this fixed it for us. Many thanks!