Overview of Hybrid Mail Flow
The Hybrid deployment between Exchange Server (on-premises) and Exchange Online provides secure mail routing between on-premises and Exchange Online organization with t...
Updated Jun 13, 2025
Version 3.0
Blog Post
Hi,
I'm not sure if I got your question right but I never change the TlsCertificateName for new certificates. What you have to do is to delete the old (but same) name from your connectors and add the name after removing the old certificate. I use this little script:
#import certificate
Import-ExchangeCertificate -Server <servername> -FileData ([System.IO.File]::ReadAllBytes('<certificate-path>')) -Password (Get-Credential).password
get-ExchangeCertificate
#Build TlsCertificateName
$Cert = Get-ExchangeCertificate -Thumbprint <thumbprint new certificate>
$TLSCertificateName = "<i>$($Cert.Issuer)<s>$($Cert.Subject)"
$TLSCertificateName
#remove old TlsCertificateName
Get-ReceiveConnector | where {$_.bindings -like "*:25" -or $_.bindings -like "*:587"} | Set-ReceiveConnector -TlsCertificateName $Null
Set-SendConnector -TlsCertificateName $Null
#now delete old certificate
Remove-ExchangeCertificate -Thumbprint <thumbprint old certificate>
#Set new TlsCertificateName
Get-ReceiveConnector | where {$_.bindings -like "*:25" -or $_.bindings -like "*:587"} | Set-ReceiveConnector -TlsCertificateName $TLSCertificatename
Set-SendConnector -TlsCertificateName $TLSCertificatename
So pretty much the same thing I do except you switch to 'no certificate' instead of 'other certificate'. It's still the same basic problem of not being able to switch the binding to a new certificate when the new and old certificate have identical names - which public certificates usually do.
$null is admittedly more convenient, so I'll switch over to doing that. I don't know how it didn't occur to me.