Exchange Default Self Signed Certificates

Hello All,

I have my exchange 2019 server setup and working fine for passing mail.  OWA and the wildcard cert I have works fine for OWA, mail clients, etc.  No problems with normal mail flow, or utilizing the wildcard cert I purchased from Sectigo RSA Domain Validation Secure Server .

I do have an issue when attempting to telnet into Exchange using openssl in order to run starttls.  I am able to get connected via openssl and I am passed a certificate from the exchange server, BUT it is not the certificate I am expecting.  Instead of getting the wildcard certificate from Sectigo RSA Domain Validation Secure Server , I am getting a self signed certifcate.  Which is why I believe my Ehlo after starttls fals with '501 5.5.4 Invalid domain name'.

Looking at EAC I have four certificates total
Name:  Microsoft Exchange,  self signed certificate, assigned services:  SMTP
Name:  Microsoft Exchange Server Auth Certificate, self-signed certificate, assigned to services SMTP
Name:  Wild, Sectigo RSA Domain Validation Secure Server, assigned services IMAP, POP, IIS, SMTP
Name:  WMSVC-SHA2, self-signed certificate, assigned to services SMTP.

Can I remove any of the self-signed certificates?

Is there a way to specify when using openssl to specify which certificate it should use?

my understanding is IIS needs the WMSVC-SHA2 cert....