Forum Discussion
HCW - Hybrid Configuration Wizard for Hybrid Certificate
I've gone through about 5 Microsoft Exchange Support Engineers for last two years with Exchange on-line migration and 80% of time running HCW, it caused email outages where the engineers did not know what to do. They've also gave conflicting information on how to correctly run HCW for adding server and to replace certificate. Some say use powershell and some says do not use powershell.
Now, I need to replace the hybrid certificate, do I uncheck everything and check only "Update Secure Mail Certificate for connectors" in a centralized transport setup (email flows through on-prem servers) ? I assume uncheck everything will not roll back configurations. I have Microsoft Exchange engineers says it will and some say it won't and they all say they have 20+ experience.
2 Replies
For a rerun whose only purpose is replacing the hybrid transport certificate, deselect everything except “Update Secure Mail Certificate for connectors.” Microsoft states that this updates the TLS certificate references on the Microsoft 365 connectors and on-premises send and receive connectors while preserving other connector settings. Deselecting other items skips them for this run; it does not roll back the hybrid configuration. Before HCW, install the new certificate on every hybrid server, include the required SMTP name, enable it for SMTP, and leave the old certificate installed. Export connector settings and schedule mail-flow tests. In HCW, choose the new certificate, review the final summary, then run the update. Afterward, test inbound and outbound hybrid mail flow and TLS, and inspect the HCW log. Remove the old certificate only after every hybrid server and connector references the new one. This granular route avoids rewriting unrelated coexistence, migration, OAuth, or centralized-transport settings.
Yes. For a certificate-only change, deselect the other HCW options and select only Update Secure Mail Certificate for connectors.
The warning shown in your screenshot is the important part: deselecting an item does not undo the existing hybrid configuration. It tells HCW to skip that item during this run. Therefore, deselecting Enable Centralized Mail Transport does not turn off centralized mail transport; it simply prevents HCW from changing that setting while you update the certificate.
Before running HCW, make sure the replacement public certificate is installed on every on-premises Exchange server that handles hybrid mail flow, includes its private key, is valid for the required SMTP name, and is enabled for SMTP. Take note of the current connector and certificate settings first. Then run HCW during a change window, select the new certificate when prompted, and complete only the certificate update.
Afterward, test mail flow in both directions, including a message that follows the centralized transport path. Also confirm that the Exchange Online connectors and the on-premises hybrid send/receive connectors now reference the new certificate.
There is no need to manually modify the hybrid connectors with PowerShell merely to renew the certificate. HCW is the appropriate tool for this specific change. PowerShell is useful for checking the current configuration before and after the wizard, but changing connector settings manually at the same time makes troubleshooting harder.
