Which Exchange configuration areas should be reviewed

Hi @Santiago Cruz

Thank you for posting your question in Microsoft Q&A. 

I understand you are troubleshooting issues after recent infrastructure changes, including certificate renewal and firewall updates, which can commonly affect TLS bindings, external endpoint accessibility, OAuth authentication, and network connectivity in an Exchange Hybrid environment.

You could begin by reviewing the following areas first.

Certificates and TLS Bindings 

Verify the renewed public certificate is installed in the correct store (Local Computer → Personal) and assigned to IIS and SMTP services: 

Get-ExchangeCertificate | FL Thumbprint,Services,NotAfter  

Confirm the Hybrid Send Connector references the correct TLS certificate (this is critical for Hybrid mail flow): 

Get-SendConnector | FL Name,TlsCertificateName  

If the connector is still pointing to the old certificate, update it via this command: 

Set-SendConnector "Outbound to Office 365*" -TlsCertificateName "<I>Issuer<S>Subject" 

Review Receive Connectors only if they are customized (for example, relay or explicitly configured TLS connectors): 

Get-ReceiveConnector | FL Name,TlsCertificateName  

Ensure the public certificate includes the required Subject Alternative Names (SANs), for example: 

mail.yourdomain.com 

autodiscover.yourdomain.com 

Validate that IIS HTTPS bindings on all Internet‑facing Exchange servers or load balancers are using the renewed certificate. 

For Autodiscover and Free/Busy, confirm SSL certificates are correctly applied on the EWS and Autodiscover virtual directories. 

Firewall and Network Rules 

Confirm inbound and outbound firewall rules allow: 

TCP 443 (HTTPS – Autodiscover, EWS, OAuth, Hybrid services) 

TCP 25 (SMTP – Hybrid mail flow) 

Verify there is no SSL/TLS inspection or pre‑authentication applied to Microsoft 365 traffic, as this can break OAuth and TLS trust. 

Test external access using Microsoft Remote Connectivity Analyzer: https://testconnectivity.microsoft.com 

Validate firewall connectivity to ports 25 and 443 from external sources where applicable. 

If a proxy is used, confirm it is correctly configured on Exchange: 

Get-ExchangeServer | FL InternetWebProxy  

Set it if required: 

Set-ExchangeServer -Identity "ServerName" -InternetWebProxy "http://proxy:8080" 

Check load balancer or reverse proxy configurations (if present) to ensure they are not blocking or modifying: /ews/exchange.asmx, /autodiscover, /metadata/json 

Review IIS logs (%SystemDrive%\inetpub\logs\LogFiles) for HTTPS errors (401/403/500) from external client IPs. 

OAuth and Federation Authentication 

Verify the OAuth certificate configured in AuthConfig matches an existing, valid certificate: 

Get-AuthConfig | FL CurrentCertificateThumbprint  

If necessary, update and publish the new OAuth certificate: 

Set-AuthConfig -NewCertificateThumbprint <NewThumbprint> 
Set-AuthConfig -PublishCertificate 
iisreset  

Test OAuth connectivity for Hybrid Free/Busy via: 

Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office.com/EWS/Exchange.asmx -Mailbox ******@domain.com 

Validate federation trust health:  

Test-FederationTrust -UserIdentity ******@domain.com -Verbos

Recreate trust using the Hybrid Configuration Wizard if errors are detected. 

Ensure server time is synchronized (within arround 5 minutes of NTP sources), as OAuth tokens are time‑sensitive. 

I hope this helps. 

Please understand that our initial reply may not always immediately resolve the issue. However, with your help and more detailed information, we can work together to find a solution. 

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".      

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.