Microsoft Exchange TLS certificate expired

Exchange still needs valid TLS on hybrid and on-prem roles—even when mailboxes moved to Microsoft 365.

When this happens

Outlook mobile reports certificate errors on autodiscover.company.com. Load-balanced CAS arrays present different certs depending on which DAG member answers NLB probes. Hybrid connectors may reference FQDNs that no longer match the reissued SAN list after cloud consolidation projects.

Hybrid connectors fail STARTTLS after unified comms cert expired. Reverse proxy publishing OWA may present different cert than internal ECP. Legacy UM and Skype roles still bound to expiring SANs after partial Exchange upgrades leave hidden service dependencies.

First response

Renew expired Exchange or hybrid TLS certificates for autodiscover, OWA, and SMTP—bind services in IIS.

Searches for exchange certificate expired usually mean automated renewal failed, succeeded locally but never reached the TLS listener, or hit Let's Encrypt rate limits. The fix is almost always permissions, challenge reachability, or a missing reload—not buying a longer-lived commercial cert as the first move.

For Microsoft Exchange TLS certificate expired, read the ACME or panel error verbatim, run a dry-run renewal if your stack supports it, then confirm what certificate strangers receive on port 443 after you deploy. Certificate files on disk lie; only live handshakes matter for users.

Exchange and hybrid connectors still terminate TLS locally even when mail flows to Microsoft 365. Expired certs on autodiscover, OWA, or SMTP relays break migration coexistence and mobile ActiveSync. Replacement means new CSR on the Exchange server or panel, not only Entra app secrets. Triage should capture timestamps, account URLs, and the last Boulder error type before infrastructure changes widen blast radius. Pause destructive retries until you can cite the last Boulder error type and the challenge mechanism in use; random package reinstalls rarely fix presentation gaps.

See also AWS ACM automatic renewal failed and Expired forward trust certificate on appliances.

Why renewal failed

Exchange services bind certificates separately in IIS and SMTP connectors. Document which names must remain on the certificate for Teams phone System versus legacy Outlook Anywhere; reissues often drop an obscure SAN still referenced by autodiscover SCP. Mailbox migration to cloud does not remove every on-prem TLS dependency immediately.

Public CAs no longer issue certs for bare internal names—SAN planning matters. Hybrid modern authentication does not remove TLS requirements on on-prem connectors that still publish HTTPS endpoints to the Internet. Certificate service assignment in Exchange must be scripted post-import to avoid human skip.

Certificate renewal without Enable-ExchangeCertificate assignment leaves services on old thumbprint. Plan Skype or legacy UM cert dependencies before modern Exchange cuts unsupported bindings. Escalate with timestamps, hostnames, and serial comparisons attached so the next engineer does not repeat already-failed renew attempts.

Microsoft publishes guidance for Exchange 2019 and hybrid certificates distinct from *.outlook.com edge. Internal names no longer qualify for public issuance; use correct SANs or split DNS. Clarify in tickets whether failure is validation, issuance, deploy, or listener presentment—teams too often mix these phases when reading logs. Mail TLS incidents damage reputation faster than website warnings; prioritize autodiscover and submission names in monitoring order.

Exchange cert expiry is not fixed by renewing only Microsoft 365 user licenses. Cloudflare in front of mail ports is rarely the right fix. Hybrid mail flows fail in non-obvious directions; autodiscover may break mobile setup while web OWA still loads from a bookmarked path using another thumbprint.

Common causes

These patterns drive most exchange certificate expired tickets. They explain why automation logs look green while browsers or APIs still break.

Autodiscover CNAME pointed at on-prem with expired unified communications SAN.

Hybrid connector certificate renewed without Enable-ExchangeCertificate binding.

Forgot SMTP relay appliance using same expired cert. Third-party archiving appliances MITM SMTP with their own expired TLS for journaling.

Diagnose

Map Get-ExchangeCertificate services to external openssl probes. Pair PowerShell certificate tables with openssl on the same DNS names mobile clients resolve, not only internal split-horizon names.

Get-ExchangeCertificate | Format-List Thumbprint,Services,Status,NotAfter

Exchange Management Shell lists services bound to each thumbprint—match expired thumbprints to external openssl failures. Include Test-OutlookConnectivity or equivalent cmdlet output alongside openssl for the same hostnames. Run autodiscover probes from an external host, not only domain-joined laptops with cached SCP entries.

Fix step-by-step

Follow this sequence for microsoft exchange tls certificate expired. Capture command output after each step so the next responder can pick up without rerunning destructive changes.

1. Inventory certificates with Exchange management shell.
2. Generate CSR with supported public SANs.
3. Complete CA validation and download chain.
4. Import and assign IIS, SMTP, IMAP services as needed.
5. Recycle app pools and test OWA.
6. Validate ActiveSync and mobile clients.
7. Update load balancer if it terminates TLS for Exchange.
8. Track alongside web certificate monitoring.
9. Archive redacted ACME logs and openssl transcripts in the ticket before closing.
10. Schedule a follow-up dry-run before the next natural renewal window.

Verify the live certificate

OpenSSL

echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Replace HOST with the public hostname on the certificate. Run the same command after any reload or deploy change; acceptance means notAfter moved forward and serial changed versus the incident-opening capture.

How to read the output

openssl SMTP STARTTLS on port 587 to on-prem host; compare to Get-ExchangeCertificate output. STARTTLS probes on 587 with openssl mirror what remote senders experience when Exchange presents an expired unified communications certificate.

curl

curl -vI --connect-timeout 10 https://HOST/ 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

Replace HOST with the public hostname users request.

Roll out and verify

Generate CSR with current naming standards; complete validation with CA.

Import, assign services IIS, SMTP as needed; restart app pools. Schedule renewal in coexistence maintenance windows with Microsoft and mobile device test cohorts ready. Validate ActiveSync and Outlook mobile against the same names documented in the certificate SAN list, not internal-only labels.

Track in same dashboard as web TLS; test ActiveSync and Outlook connectivity. Publish a short post-incident note listing which hop served stale TLS and which command proved the fix so the next renewal inherits a checklist.

What to automate

Alert on autodiscover and hybrid hostnames thirty days before notAfter. Monitor autodiscover and hybrid hostnames with OWA-specific alert routing.

ssldays covers customer-visible Exchange DNS names outside Microsoft 365 edge. ssldays complements Exchange tooling for Internet-facing names.