How do you remove a renewed Federation Certificate in Exchange 2013

Hi，@Jaime Alonso

According to your description, the federated authentication certificate was deleted and then reappeared. There is a synchronization problem between the On-pre and cloud services.

Here are my suggestions:

1. Check and disable automatic certificate rotation. You can do this via Powershell:

Set-FederationTrust -Identity "YourFederationTrustIdentity" -RefreshMetadataInterval 0

2. Check every place where certificates might be stored, such as ADFS servers and Azure AD, and make sure the old certificates are deleted everywhere.

If you are using Active Directory synchronization, ensure that your changes are correctly reflected in Active Directory and synchronized to other servers.

3. Use Get-ExchangeCertificate to find the Thumbprint of the certificate you want to delete, and then use the following command to delete the certificate.

Remove-ExchangeCertificate -Thumbprint "Thumbprint of old certificate"

If my answer is helpful to you, please mark it as the answer so that other users can refer to it. Thank you for your support and understanding.

Hi , Thank you for your response. Do the steps suggested in the previous answer carry any risk? Our Onprem Org is Exchange 2013 I dont know if these steps are valid because the command "Set-FederationTrust -Identity "YourFederationTrustIdentity" -RefreshMetadataInterval 0 "is not valid.What does the command exacty do?
Could it have any affection on the service?

We did not remove the old certicate proof on txt dns value, could it be the reason of the issue?

And finally, do we have to set the value again on its previous value?

Thank you in advanced.

Hi，@Jaime Alonso

I will answer your questions in order:

1. The old certificate proof TXT DNS value was not removed:

 Yes, this could be the reason for the issue. If the old certificate proof TXT DNS value is not removed, the system may fail to verify the new certificate, leading to authentication and communication problems. Ensuring the DNS records are up-to-date and match the currently used certificate is crucial.

2. The Set-FederationTrust -Identity "YourFederationTrustIdentity" -RefreshMetadataInterval 0 command:

 This command is used to set the metadata refresh interval for Exchange federation trust. Setting the RefreshMetadataInterval parameter to 0 means disabling the automatic metadata refresh. "YourFederationTrustIdentity" This parameter should be filled with the old certificate.

3. Do we need to set the value back to its previous value:

Yes, it is recommended to restore the RefreshMetadataInterval value after resolving the issue to ensure regular metadata refresh. In general, the default value should be restored to maintain the normal operation of the system. If you are unsure of the default value, you can refer to the relevant documentation or use PowerShell commands to check the current settings.

Here are my suggestions:

1. First delete the TXT record of the old certificate and see if the problem persists.
2. Do not run the Set-FederationTrust command for the time being. If you have run it, restore the original value.

I will continue to follow up if any problems arise later.

If the problem is solved, please mark it as the answer so that other users can refer to it. Thank you for your support and understanding.

We will try first point, altough there 2 records, one for the old cert and other for the new cert.
We will delete the record next week as I will not be available this week. As soon as we do it, I will update the post. Thank you for your help @Bruce Jing-MSFT