Renew certificate broke TLS - how do I fix it?

Question

While troubleshooting another problem I followed a suggestion in a Technet document to renew my Exchange server self-signed certificate. Quite easy, right-click, renew certificate. Doing so did not fix the problem I was working on, but it did thoroughly
trash my entire Exchange setup. I managed to get Outlook and OWA working again, but TLS is broken. I have a Receive Connector set up to relay email from other internal servers and appliances. It was set up to use TLS and/or Externally Secured Authentication
and under Permission Groups, Anonymous users and Exchange servers are allowed to connect. After renewing the certificate, I had to remove TLS authentication. When enabled, those systems on which TLS is required or optional will fail to connect to send mail.
When disabled, with Externally Secured the only checked option, those systems which do not require TLS can successfully send mail, others which require TLS fail (obviously). I know that this is some failure of Exchange to use the renewed certificate to establish
TLS connections but I can't find anywhere to check or correct it. The certificate is enabled through EMC for all services but UCM, which we don't use, and I also ran enable-exchangecertificate -thumbprint "xxxxxxxxxxxxxxxxxx" -services "SMTP"
in EMS using the thumbprint value found on the Details tab of the certificate from MMC. Any help on fixing this?

Answer 1

Thanks for the suggestion, but that's not applicable here. The communications are all internal to our domain and really shouldn't have to be secured. Our Helpdesk application was using the connector w/TLS until I did the renew, then it was unable to email
us when new requests came in or to send emails back to the requestors when we closed a ticket. That was easy, when I uncheck the TLS box, it doesn't try to use TLS and it works fine. Two other servers don't email all that often and I'm not sure yet if they
work or not, I have no way to force an email from them. Then we have a couple appliances, like the chiller for a large piece of equipment, which email people when they detect a problem. That chiller has to use TLS, it's not configurable, so it's not emailing
anyone right now. It's not a member of our or any domain, it's just running an embedded OS with a built in SMTP server that's not at all configurable. The worst part is, this all worked great until I did the renew. I'm thinking I'm going to have to delete
the connector, delete the server certificate, and start over with a new certificate and connector, but that seems like such an obtuse way to fix what should be a simple problem.