Troubleshooting Outlook Certificate Errors

Introduction

A common issue after installing Exchange 2007 or 2010 users get certificate errors when connecting opening Outlook to access their mailboxes. There are a few possible reasons for this issue: 1) the certificate does not have the appropriate subject names; 2) missing DNS records; or 3) Exchange settings are not configured correctly.

Troubleshooting steps

The first step is to collect configuration information from your environment. You need to determine the subject names configured on your certificate and compare these values to the FQDN values assigned to your URLs.

Get the subject names configured on the certificate assigned to the Exchange server

Get-ExchangeCertificate | where { $_.Services.ToString().Contains(“IIS”) –eq $true } | fl Cert*

Select all Open in new window

Get the service connection point URL used by Outlook to locate the Autodiscover service

Get-ClientAccessServer CasServerName | fl AutoDiscoverServiceInternalUri

Select all Open in new window

Get the Exchange Web Services URL values

Get-WebServicesVirtualDirectory | fl *Url

Select all Open in new window

Get the Offline Address Book URL values

Get-OabVirtualDirectory | fl *Url

Select all Open in new window

Get the Autodiscover URL values

Get-AutodiscoverVirtualDirectory | fl *Url

Select all Open in new window

Get the Outlook Anywhere FQDN

Get-OutlookAnywhere | fl External*

Select all Open in new window

Here is an example of results:

CertificateDomains :             {mail.contoso.com, autodiscover.contoso.com}
                      AutoDiscoverServiceInternalUri : https://mail.contoso.com/Autodiscover/Autodiscover.xml
                      InternalUrl :                    https://mail.contoso.com/EWS/Exchange.asmx
                      ExternalUrl :                    https://mail.contoso.com/EWS/Exchange.asmx
                      InternalUrl :                    http://mail.contoso.com/OAB
                      ExternalUrl :                    https://mail.contoso.com/OAB
                      InternalUrl :
                      ExternalUrl :
                      ExternalHostname :               mail.contoso.com

Select all Open in new window

Note: The Autodiscover virtual directory results can be empty

If you need to update any of the Exchange settings you can run the following:

Set-ClientAccessServer CasSrv AutoDiscoverServiceInternalUri 
                      Set- WebServicesVirtualDirectory CasSrv\ews* -ExternalUrl –InternalUrl
                      Set- OabVirtualDirectory CasSrv\oab* -ExternalUrl –InternalUrl

Select all Open in new window

Note: After each ExternalUrl and InternalUrl you need to include the appropriate URL value, use the format from your Get cmdlets as a guideline.

Next you need to verify your DNS records both internally and externally. There must be an A record on your internal DNS server for the FQDN value used in all of the InternalUrl values, the AutoDiscoverServiceInternalUri, and the ExternalHostname. You can use the nslookup utility to validate (nslookup autodiscover.contoso.com).

Your external DNS server records are dependent on your certificate domain names. Typically your certificate should include autodiscover.yourdomain.com and you should have an associated A record. If your certificate does not include autodiscover.yourdomain.com, then your DNS server must support SRV records. The SRV record should then be configured as follows:

Service = _autodiscover
                      Protocol = _tcp
                      Port = 443
                      Hostname = (a certificate domain name value = existing A record)

Select all Open in new window

There are several web sites you can use to verify your external DNS records (http://www.dnsquery.org/).

Verification

Once your configuration is complete you can test your system externally using https://testexchangeconnectivity.com/

You can test your system internally by opening Outlook, then using the combination of Right Ctrl and Right-click on the Outlook icon in the taskbar, and select Test E-mail AutoConfiguration. Your e-mail address should auto-populate. Remove the Guessmart options and press Test.