Share via

How can we verify that the certificate is properly assigned to SMTP

Charles 140 Reputation points
2026-02-25T04:08:05.6766667+00:00

After renewing our SSL certificate on Exchange Server (on-prem), external mail flow stopped while internal mail still works. Messages are stuck in the queue with TLS errors.

How can we verify that the certificate is properly assigned to SMTP and that send/receive connector TLS settings are configured correctly to restore mail flow?

Exchange | Exchange Server | Management
Exchange | Exchange Server | Management

The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.

0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Marcin Policht 82,360 Reputation points MVP Volunteer Moderator
    2026-02-25T04:20:28.6566667+00:00

    Follow https://learn.microsoft.com/en-us/exchange/architecture/client-access/renew-certificates

    • For certificates that were issued by a CA, verify the certificate request requirements of the CA. Exchange generates a PKCS #10 request (.req) file that uses Base64 encoding (default) or Distinguished Encoding Rules (DER), with an RSA public key that's 1024, 2048 (default), or 4096 bits. Note that encoding and public key options are only available in the Exchange Management Shell.
    • To renew a certificate that was issued by a CA, you need to renew the certificate with the same CA that issued the certificate. If you're changing CAs, or if there's a problem with the original certificate when you try to renew it, you need to create a new certificate request (also known as a certificate signing request or CSR) for a new certificate. For more information, see Create an Exchange Server certificate request for a certification authority.
    • If you renew or replace a certificate that was issued by a CA on a subscribed Edge Transport server, you need to remove the old certificate, and then delete and recreate the Edge Subscription. For more information, see Edge Subscription process.

    How do you know that you successfully created a certificate renewal request?

    To verify that you have successfully created a certificate renewal request for a certification authority, perform either of the following steps:

    • In the EAC at Servers > Certificates, verify the server where you stored the certificate request is selected. The request should be in the list of certificates with the Status value Pending request.
    • In the Exchange Management Shell on the server where you stored the certificate request, run the following command:
    Get-ExchangeCertificate | where {$_.Status -eq "PendingRequest" -and $_.IsSelfSigned -eq $false} | Format-List FriendlyName,Subject,CertificateDomains,Thumbprint
    

    If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

    hth

    Marcin

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.