How to Fix Exchange Hybrid Error 450 4.4.317 UntrustedRoot
Question details
Mail flow fails from Microsoft 365 to on-premises Exchange, returning error 450 4.4.317 UntrustedRoot.
- Product
- Microsoft Exchange
- Device & OS
- not provided
- Scenario
- Maintaining or setting up hybrid mail flow between Microsoft 365 and an on-premises Exchange server.
- Observed behavior
- Mail delivery fails with an UntrustedRoot error message, indicating a TLS certificate trust issue or an invalid hybrid connector configuration.
Ensure you have administrative access to both the on-premises Exchange admin center and the Microsoft 365 Exchange admin portal to verify certificate configurations.
Verify TLS Certificates and Rerun the Hybrid Configuration Wizard
Resolve the UntrustedRoot error by validating your on-premises receive connector certificates and updating the hybrid connector settings.
This error typically occurs when Microsoft 365 cannot verify the authenticity of the TLS certificate presented by the on-premises Exchange server. Fixing it requires ensuring the certificate is valid, properly trusted, and bound correctly to SMTP services.
Access your on-premises Exchange admin center and ensure the third-party TLS certificate assigned to your SMTP services is valid, not expired, and contains the correct subject names.
Confirm that the certificate's root and intermediate authorities are fully trusted by Microsoft 365 and properly installed on the local on-premises server.
Launch the Office 365 Hybrid Configuration Wizard to automatically update and correct the inbound and outbound connector configurations based on the valid certificate.
If the problem persists after verifying certificates and rerunning the HCW, visit the Microsoft Q&A Exchange hybrid forum, as this requires advanced server-side troubleshooting.
Try WPS Office for Your Daily Productivity Needs
While resolving Microsoft Exchange server configurations requires specialized IT administration, your daily document work shouldn't be complicated. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for creating documents, spreadsheets, and presentations.
- 1. Download WPS Office: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install the application: Run the setup file and follow the on-screen prompts to complete the lightweight installation process in minutes.
- 3. Open your files: Launch WPS Office and instantly open your existing Word, Excel, or PowerPoint files without losing any formatting.
Frequently Asked Questions
What does the UntrustedRoot error mean in an Exchange Hybrid environment?
It indicates that Microsoft 365 cannot verify the authenticity of the TLS certificate presented by your on-premises Exchange server because the root certificate authority is not trusted or the certificate chain is broken.
Do I need a third-party certificate for Exchange hybrid mail flow?
Yes, Microsoft recommends using a valid third-party SSL/TLS certificate from a globally trusted Certificate Authority (CA) to secure mail flow between Microsoft 365 and on-premises Exchange servers.
Will restarting the Exchange Transport service fix the error?
Simply restarting the service will not fix the issue if the underlying certificate is invalid or the trust chain is missing. You must correct the certificate bindings and verify the chain before restarting the service.
