EdgeSync failed to decrypt the credential for Edge Transport - Eventid 1033 MSExchange EdgeSync - Renewed certificate lately?

EdgeSync failed to decrypt the credential for Edge Transport server sr-xxxx.domain.lan using the private key of the default Exchange certificate with exception Invalid provider type specified.

. The certificate's thumbprint is XXXXXXXXXXXXXXXXXXXX52F0283F5F8BDDD13058 and its subject is CN=autodiscover.domain.nl, OU=ICT, O=Company., L=City, S=State, C=NL.

Use either Enable-ExchangeCertificate or New-ExchangeCertificate to set the proper Exchange default certificate and re-subscribe the Edge Transport server sr-XXXX.domain.lan again.

Well...here we go again.

At least I'm not bored at work.

Quick recap, this was after renewing our old Exchange certificate that had the SMTP service assigned to it. The old certificate was an old SHA1 type, this is very important to keep in mind as it comes back later in the solution.

In my quest to solve this as quickly as possible I came across some other strange things, which I will list later on.

But first let me sum up all the steps needed to resolve this:

1. On the Edge server request a new Exchange certificate:
   New-ExchangeCertificate
2. Generate a new EdgeSubscription file:
   New-EdgeSubscription -FileName C:\Temp\Servername.xml
3. Copy the EdgeSubscription file to an Exchange 2013 or 2016 or 2019 server (I'm assuming you installed multirole)
4. Remove the current EdgeSubscription(s):
   Get-EdgeSubscription | select Name
   Remove-EdgeSubscription -Identity YourEdgesubscriptionName
5. Find the current self signed Exchange Certificate with the servername as Subject. This certificate is created at installation. This certificate needs to get the SMTP service reassigned to it. Copy the thumbprint, we need it in the second command:
   Get-ExchangeCertificate | fl
   Enable-ExchangeCertificate -Thumbprint XXXXXXXXXXXXXXXXXX334EFEA37EFC7E5813 -DoNotRequireSsl -Services:SMTP
6. Double check your existing subscription has been deleted:
   Get-EdgeSubscription
7. Create a new Edge Subscription with the file copied in step 3:
   New-EdgeSubscription -FileData ([byte[]]$(Get-Content -Path "C:\Temp\Servername.xml" -Encoding Byte -ReadCount 0)) -Site YourSiteName
8. Then start your newly created subscription:
   Start-EdgeSynchronization
9. Test the EdgeSynchronization:
   Test-EdgeSynchronization
10. The last step is to sync everything:
    Start-EdgeSynchronization -ForceUpdateCookie -ForceFullSync

The problem I had was the certificate that got renewed initialy was a SHA1 certificate.

The one it got replaced with was a SHA256 certificate. When trying to renew the Edge Subscription the following error popped up:

A special Rpc error occurs on server sr-xxxxx Invalid provider type specified

This the SHA1 part I mentioned earlier. The Edge Subscription only works with SHA1 certificates.

Strange and not very secure, eventho it is meant for internal Exchange server traffic only.

Hence the default certificate created at installation of Exchange itself is needed, which is SHA1.

Solved.