I upgraded my On-Premises Hybrid Exchange server recently, from Exchange 2016 to Exchange 2019. I remembered to add the new server onto the Office 365 send connector, but there was no mail flow between an on premises mailbox and an office365 mailbox?


This happens because, (even if you are using the same certificate on the new and old servers) the certificate that is used for TLS security between your on-premises Exchange server and Exchange online, does not get ’embedded’ properly on the send/receive connectors. You may see either (or both) of the following two problems.

Check The Office 365 Mail Flow

Log into Office 365 > Admin > Exchange Admin Center > Mail Flow > Connectors > Select the ‘Outbound’ connector > Validate this connector.

Herein lies the problem!

450 4.4.317 Cannot connect to remote server [Message=SubjectMismatch] [LastAttemptedServerName={on-prem-fqdn}] [LastAttemptedIP={on-prem-ip}}:25] [{outlook-FQDN}]

Message=SubjectMismatch Error

At first I thought the on-premises server was presenting the wrong cert for TLS, turns out it was not presenting a cert at all! You can check by executing the following command on the RECEIVE CONNECTOR;

Get-ReceiveConnector "{SERVER-NAME}\Default Frontend {SERVER-NAME}" | fl TlsCertificateName  

If it returns no entry (like the image below), then you need to simply attach the correct certificate. To do that first get the ‘thumbprint’ of the correct certificate;


Copy the correct thumbprint, and embed it with the following commands;

$tlscert=Get-ExchangeCertificate {THUMBPRINT} $tlscertname="<I>$($TLScert.Issuer)<S>$($TLSCert.Subject)" Get-ReceiveConnector "{SERVER_NAME}\Default Frontend {SERVER_NAME}" | Set-ReceiveConnector -TlsCertificateName $tlscertname Restart-Service MSExchangeTransport

Validate connector Office365 Fails

Now test validation again from Office 365 portal.

Sucessfully Validate Office365 Fails

Check The Office On-Premises Mail Flow

To do this, open Exchange Tools > Queue Viewer, and you will probably see something like this;

Send Connector to Office 365 Fails

454 4.7.5 The certificate specified in TlsCertificateName of the SendConnector could not be found.

To fix this, the procedure is much the same as above, only this time you perform the procedure on the SEND CONNECTOR ;

Note: I’m assuming you are using the same Thumbprint you used above,

$tlscert=Get-ExchangeCertificate -Thumbprint {THUMBPRINT} $tlscertname = (‘<I>’+$tlscert.issuer+'<S>’+$tlscert.subject) Set-SendConnector -Identity "Outbound to Office 365" -TLSCertificateName $tlscertname Restart-Service MSExchangeTransport

Send Connector to Office 365 TLS Name