after you renew ssl cert on exchange, assigned service to the new cert. when trying to remove the old ssl cert, seeing the following error:

this is cause: you need also renew the ssl cert on send connector to 365.

Get-SendConnector
Get-ExchangeCertificate

use above 2 PS to get info, and copy down thumbprint of the new ssl cert. then use the following PS to finish update/renew ssl cert on send connector – Outbound to Office 365:

$cert = Get-ExchangeCertificate -Thumbprint (your thumbprint)

$tlscertificatename = “<i>$($cert.Issuer)<s>$($cert.Subject)”

Set-SendConnector “Outbound to Office 365” -TlsCertificateName $NULL

Set-SendConnector “Outbound to Office 365” -TlsCertificateName $tlscertificatename

*set new ssl cert on receive-connector:

Set-ReceiveConnector “xyz(1-10).domain.com\Default Frontend xyz(1-10).domain.com” -TlsCertificateName $tlscertificatename

*enable new ssl cert on all exchange servers service

Enable-ExchangeCertificate -Server “xyz(1-10).domain.com” -Thumbprint 95DFF4FAC027DECA8C53B076273C37BB3026951E -Services SMTP,IMAP,IIS