450 4.4.317: remote server sends an incomplete certificate chain
During the TLS handshake the other server sent only its own certificate, and Exchange Online could not verify it against a trusted root.
- Microsoft
- Provider
- Temporary (4xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 450 4.4.317
- Temporary or permanent
- TemporaryThe sending server keeps the message and tries again later.
- Who has to act
- Either side, depending on the cause. Start with the checks below that are yours.
- What the server says
450 4.4.317 Cannot connect to remote server [Message=UntrustedRoot]
What it means
Exchange Online validates a certificate by building a chain from the server's certificate, through any intermediate authorities, to a root that Microsoft trusts. It never fetches missing intermediate certificates itself. If a remote server presents only its leaf certificate, the chain cannot be built and the connection fails with this error. It happens in both directions: when Exchange Online sends to that server, and when that server sends to Exchange Online, in which case the remote side writes the bounce. Microsoft's own servers always send the full chain, so the fix is on the remote server.
Common causes
- The remote mail server is configured with its certificate but without the intermediate certificates.
- The certificate was renewed and the new intermediate files were not installed with it.
How to fix it
- 01If you are a user, forward the report to your email admin.
- 02If you run the remote server, configure it to present the full chain: its certificate followed by every intermediate certificate.
- 03If you run the Exchange Online tenant, send the report to the remote organization's admin, since Exchange Online does not fetch missing intermediates itself.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- NDR error code 450 4.4.317 "Cannot connect to remote server [Message=UntrustedRoot]"learn.microsoft.com
- Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
Related codes
- 550 5.7.64Relay not attributed to your tenant.Microsoft 365 could not match your on-premises server to an inbound connector, so it refused to relay its mail.
- 450Mailbox temporarily unavailable.The server did not take the message for this mailbox for now, because the mailbox is busy or temporarily blocked by policy. The sending server will try again.
All 111 Microsoft codesEvery code in the wikiPaste your own bounce