After you have obtained a certificate from a trusted CA, complete the following steps on an Exchange 2016 server to import ...

After you have obtained a certificate from a trusted CA, complete the following steps on an Exchange 2016 server to import your certificate and configure %BRAND_EXCHANGE_ONLINE_SHORT% services to use the certificate for your hybrid deployment. You will also need to import the certificate to your Mailbox servers and assign %BRAND_EXCHANGE_ONLINE_SHORT% services.