"TLS negotiation failed with error UnknownCredentials" error after you update TLSCertificateName on Office 365 send connector in Exchange Server hybrid environment

Applies to: Exchange Server 2019Exchange Server 2016Exchange Server 2013

Symptoms


In a Microsoft Exchange Server 2019, 2016, or 2013 hybrid environment, you associate a certificate with the Office 365 send connector by using the TLSCertificateName parameter. When you send an email message to Office 365, the email message may be stuck in the send queue and you may receive the following error message in the protocol log:
TLS negotiation failed with error UnknownCredentials.

Cause


This issue occurs because the certificate isn't enabled for the SMTP service and Exchange Server doesn't check whether the certificate is enabled for the SMTP service when it's associated with the send connector.

Resolution


To fix this issue, install one of the following updates:
For Exchange Server 2019, install the Cumulative Update 2 for Exchange Server 2019 or a later cumulative update for Exchange Server 2019.
For Exchange Server 2016, install the Cumulative Update 13 for Exchange Server 2016 or a later cumulative update for Exchange Server 2016.
For Exchange Server 2013, install the Cumulative Update 23 for Exchange Server 2013 or a later cumulative update for Exchange Server 2013.

References


Learn about the terminology that Microsoft uses to describe software updates.