Exchange default self-signed certificate

Dear Đức,

From my research, The Exchange Back End website on port 444 handles internal proxy traffic. Client Access (front end) services on the Default Web Site use it to pass requests to the back end services on the Mailbox server. During setup, Exchange binds the Microsoft Exchange self signed certificate to this site, and that certificate contains the server's hostname and FQDN.

Microsoft's guidance is to leave that binding unchanged. Your public SAN certificate belongs on the Default Web Site, which is the site your clients connect to. If the binding on the Back End site is removed or changed, services such as OWA, ECP, ActiveSync and the Exchange Management Shell can stop working. Your public certificate doesn't include the server FQDN, so it isn't a suitable replacement for the internal traffic in any case.

You can review the details here:

Digital certificates and encryption in Exchange Server | Microsoft Learn

Assign certificates to Exchange Server services | Microsoft Learn

If you need formal confirmation from Microsoft for your environment, you can open a business support request for Exchange Server, please note that the standard support included with Microsoft 365 covers cloud services only, not on premises Exchange Server. If your organization has a Unified or Premier agreement, you can raise it through that channel instead. Support options are listed at Contact Microsoft customer support.

I hope this clarifies things. Feel free to reply if you have any further questions about your certificate setup.

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.