Tell me about the issue and I’ll help you find the solution you need.
Can't receive mail in a hybrid environment after you install a new certificate on the server
Content provided by Microsoft
Applies to: Exchange OnlineExchange Server 2016 Enterprise EditionExchange Server 2016 Standard EditionExchange Server 2013 EnterpriseExchange Server 2013 Standard EditionMore
After you install a new Exchange certificate in an Exchange hybrid environment, you experience the following symptoms:
You cannot receive mail from the Internet or from Office 365 when you use Transport Layer Security (TLS).
If you use Telnet (for example, telnet localhost 25) to examine Simple Mail Transfer Protocol (SMTP) communications, you notice that the STARTTLS command is missing.
If you examine the Application log in Event Viewer, you see an event that resembles the following:
Log Name: Application Source: MSExchangeFrontEndTransport Date: MM/DD/YYYY 0:00:00 AM Event ID: 12014 Task Category: TransportService Level: Error Keywords: Classic User: N/A Computer: <HybridServerName>.contoso.com Description: Microsoft Exchange could not find a certificate that contains the domain name <I>CN=Certificate Name, OU=<CertificateIssuer>, O=Certificate Provider, C=US<S>CN=mail.contoso.com, OU=IT, O=contoso, L=location, S=location, C=US in the personal store on the local computer.
The check connectivity test to the on-premises server fails and you receive the following error message:
450 4.4.101 Proxy session setup failed on Frontend with '451 4.4.0 Primary target IP address responded with "451 5.7.3 STARTTLS is required to send mail." Attempted failover to alternate host, but that did not succeed. Either there are no alternate hosts, or delivery failed to all alternate hosts. The last endpoint attempted was <endpoint>'.
This issue occurs if the TlsCertificateName property of the hybrid server’s receive connector contains incorrect certificate information. This property is set correctly when the Hybrid Configuration wizard is run after a new Exchange certificate is installed. However, if the Hybrid Configuration wizard is not run or if this failure occurs for any other reason, the TlsCertificateName property is not updated, and the new Exchange certificate is not used by the hybrid server’s receive connector. In this scenario, the STARTTLS command will not be present in SMTP communications.
Remove the TLSCertificateName and TLSDomainCapabilities properties from the receive connector on the hybrid server. To do this, follow these steps: