Exchange 2010 changed transport server cert, now edge sync fails

Posted on 2014-09-08
Medium Priority
Last Modified: 2014-09-08
I replaced my main exchange server's certificate and now the edgesync fails.

When I do a "Start-EdgeSynchroinzation" on the hub transport server I get:

Result: CouldNotConnect
Type: Recipients
Result: CouldNotConnect
Type: Configuration

and the "Test-EdgeSynchronization" command Returns this:

SyncStatus: Failed
UtcNow : [a few seconds ago]
FailureDetail: EdgeSync service cannot connect to this subscription because of error "No EdgeSync credentials were found for Edge Transport server. Remove the Edge subscription and re-subscribe to the Edge Transport server."
CredentialRecords: Number of credentials 0
CookieRecords: Number of cookies 0

Just to be clear it was the cert on the hub transport that was replaced, not the cert on the edge server.

I've removed the edge subscription from the hub transport server using EMC then went to the edge server and ran:

New-EdgeSubscription -FileName C:\Users\Administrator\Desktop\edge-subcription.xml

Then copied the file to the hub transport server and used "New Edge Subscription" in the EMC to re-add the subscription. After adding the subscription the EMC shows the EXCH2-EDGE subscription as valid under the "Is Valid" column.

However when I run the Start-EdgeSynchronization or Test-EdgeSynchronization commands (on the hub transport server) in the EMS I get the results I posted above. Given that it was the Hub transport that had it's cert replaced, it's likely that the edge server can't authenticate against the hub transport and not the other way around. Does anyone have any idea how I can fix this?
Question by:jdhwpgmbca
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 40310671
What did you replace the certificate with?
A trusted certificate or self signed?

In most instances, you now need two certificates on Exchange.
- A trusted certificate for web services etc.
- A self signed certificate as the default SMTP certificate for internal traffic.

Therefore the easiest fix is to run


on the Hub transport server, no further attributes required. When prompted to replace the default SMTP certificate say Yes. Then test again.


Author Comment

ID: 40310699
A trusted cert from comodo. I just paid $600 for it, so I'm reluctant to run new-exchangecertificate on the hub transport. That would generate a new key which would need to be re-signed by the CA. Besides, I'm not convinced that doing that is any different from generating a request and having it signed by a CA then importing the cert (in EMC). It's not that the advice isn't appreciated - but I don't want to lose my new certificate.

Author Comment

ID: 40310749
I think it's likely that changing the web server certificate on the hub transport is what broke the trust between the servers. In order to re-establish the trust I have to get the edge server to refetch the ldap information containing the hub transport certificate into it's AD-LDS. I just don't know how to do this.
LVL 63

Accepted Solution

Simon Butler (Sembee) earned 2000 total points
ID: 40310841
$600 for an SSL certificate? You can get ones suitable for Exchange for less than $70/year!
Anyway, I am not proposing replacing your trusted certificate, this is an additional SSL certificate for SMTP traffic only. New-Exchangecertificate on its own creates a new self signed certificate, which Exchange trusts.

Exchange wants to communicate with the server over SMTP using its real FQDN. However with SSL certificates that expire after November 2015 you cannot put internal names on the certificates, so you need to use a combination of trusted certificates and a self signed certificate.


Author Comment

ID: 40311018
There's a bunch of Subject-Alt-Names, they say that's why it's so expensive, but I think it's a rip-off. Anyway that's off topic.

Thanks for the tip about needing two certificates, that's what did it. I generated a new cert on the hub transport using New-ExchangeCertificate. It asked me if I wanted to replace another certificate and identified the certificate as something that expired yesterday (it also showed the certs fingerprint). This was obviously not my commercial cert so I just answered yes to the prompt. After this I needed to do a "Start-EdgeSynchronization -ForceFullSync" on the hub transport. This sent the certificate to the edge server. And after this everything worked fine.


Featured Post

Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Find out what you should include to make the best professional email signature for your organization.
How to resolve IMCEAEX NDRs in Exchange or Exchange Online related to invalid X500 addresses.
In this video we show how to create a Shared Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Sha…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…
Suggested Courses
Course of the Month11 days, 5 hours left to enroll

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question