Updated on 2/10/2021
Microsoft periodically refreshes certificates in Office 365 as part of our effort to maintain a highly available and secure environment. From Jan 23 rd , 2021, we are making a ...
Updated Feb 10, 2021
Version 8.0
Blog Post
The_Exchange_Team Mirela_Buru I would like to point out that you have a missing process around Federation Trust. That is - there's no official way to clean off the old expired Federation Delegation certificate. You can use ADSI Edit, which is an unsupported and undocumented process.
This Exchange 2013 process is all that there is for guidance on updating the certificate. There is nothing for how to get rid of the old certificate. I've seen in two separate environments how deleting the old cert from the servers and from AD's Configuration partition via ADSI Edit, results in the certificate ghostily coming back into the Exchange Admin Center as "invalid" and causing notifications about being expired.
Regarding this blog post - 6 weeks is pretty short notice. On top of that, having no clean way to do away with the old Federation Delegation certificate is just no good. I raised the latter issue in the past when the linked Docs article I gave above was editable via GitHub, and was shut down because the ADSI process is not official. It seems like right now is the perfect time for you to double back and make a proper process for the old cert removal, while you have this upcoming change in 6 weeks that is in this general realm anyway.