Should you decide to leave the self-signed certificate(s) on some servers and continue to use them, these will need to be renewed when they expire - just as you would renew certificates from 3rd-party or in-house CAs. For client communication in production environments, it’s recommended to use certificate signed by a trusted CA. Self-signed certificates are great for securing communication by default and handy for test environments.

For most deployments, you will end up purchasng a certificate from a trusted 3rd-party CA (or perhaps an internal CA in organizations with PKI deployed). Although self-signed certificates work perfectly well for internal SMTP communication between Hub Transport servers, and between Hub Transport and Edge Transport servers, it’s not recommended to use them for any client communication on an ongoing basis. Nevertheless, one should treat these certificates as temporary. This is a great development – it ensures that data will not be transferred in the clear by default and all communication is encrypted. The self-signed certificate meets an important need – securing communication paths for Exchange services by default. In Exchange 2010, the certificate validity period is raised to five years. In Exchange 2007, the certificate is issued for a period of one year. Exchange 2010 and Exchange 2007 Setup creates a self-signed certificate for the server to protect communication with services like SMTP, IMAP, POP, IIS and UM.

Exchange 2010 self signed certificate