6.5.2 Microsoft Exchange Server

Exchange services, hybrid connector bindings, and multi-server deployment

The Microsoft Exchange Server template enables an RSA certificate for selected Exchange services and can refresh Send and Receive connector TLS bindings.

Requirements

  • Use a certificate with an RSA key. The template does not accept an EC certificate.
  • Run the deployment on an Exchange server with the Exchange Management Shell available.
  • Deploy the certificate to every Exchange server that needs it. Receive connectors are local to a server, and a Send connector can span several source transport servers.

Exchange services

The default service list is IIS,SMTP. Supported values are:

IIS, SMTP, SMTPClientAuth, IMAP, POP, Federation, UM, and UMCallRouter.

Use SMTP without IIS for a dedicated transport certificate that should not replace the OWA, ECP, or EWS certificate.

Connector TLS binding update

The Connector TLS binding update setting accepts auto or off.

  • auto updates a connector when its TlsCertificateName points to an older certificate with the same subject. This covers the issuer change that can occur when a CA changes intermediates, including Exchange hybrid connectors created by the Hybrid Configuration Wizard.
  • off leaves all connector bindings unchanged.

Auto mode does not modify connectors with no TlsCertificateName, connectors bound to another subject, or connectors when SMTP is not in the selected service list.

Exchange identifies these bindings by issuer and subject rather than thumbprint. A connector can therefore become stale after a CA intermediate changes even though the renewed leaf certificate has the same subject.

After deployment

The template does not restart Exchange services. Transport can take several minutes to use an updated connector binding. If hybrid mail flow still uses the prior certificate, confirm that:

  1. The deployment ran on every source transport server.
  2. SMTP was selected.
  3. Connector update mode was auto.
  4. The connector was already bound to a certificate with the same subject.

For a product overview, see certificate automation for Exchange Server.