I recently had a client experience an issue with their hybrid exchange setup (365/On Premise) – users were suddenly unable to retrieve free/busy and calendar information between the two environments. As it turns out, the certificate used to secure communications to the Microsoft Federation Gateway (MFG) had expired.

Federation certificates within exchange are generally created as part of the federation creation wizard (or the 365 Hybrid Configuration Wizard) – so in most cases, people don’t realise they’ve been created. If you’re not actively monitoring certificate expiry dates on your servers (which you should be!), you may get into the situation where this certificate expires – which results in the federation no longer working.

Why is it important to renew it before it expires? Because if you don’t, you need to remove and re-create the federation – a significantly larger task than the federation certificate renewal process. The reason for needing to re-create the trust is due to the fact that the federation certificate is used to authenticate any changes to the federation – so once it expires you can’t make any changes and have to start from scratch. Lets take a look at the steps involved in both:

Renewing before expiry:

1. Create a new self-signed federation certificate
2. Set the new certificate as the ‘Next’ certificate in the federation trust
3. Wait for AD replication
4. Test the certificate and trust (Test-FederationTrustCertificate, Test-FederationTrust)
5. Roll-over the ‘Current’ certificate to the ‘Next’ certificate
6. Refresh the federation metadata

Renewing after expiry:

1. Document the existing trust settings (federated domains, federation settings)
2. Force remove each federated domain from the federation
3. Remove the federation trust
4. Wait for AD replication
5. Create a new self-signed federation certificate
6. Create a new federation trust
7. Update the trust organisation information
8. Configure the required settings in the trust (as per the documentation you created in step 1)
9. Wait for AD replication
10. Test the certificate and trust (Test-FederationTrustCertificate, Test-FederationTrust) – it can take 12-48 hours before the trust reports as being no longer expired!
11. Add each of the federated domains back into the trust (this will involve generating domain ‘Proof’ entries and adding them to your external DNS, then waiting for DNS propagation)

So in short, don’t let your federation certificates expire!