Troubleshooting Outlook Certificate Errors

Published on
31,676 Points
3 Endorsements
Last Modified:
Community Pick


A common issue after installing Exchange 2007 or 2010 users get certificate errors when connecting opening Outlook to access their mailboxes. There are a few possible reasons for this issue: 1) the certificate does not have the appropriate subject names; 2) missing DNS records; or 3) Exchange settings are not configured correctly.

Troubleshooting steps

The first step is to collect configuration information from your environment. You need to determine the subject names configured on your certificate and compare these values to the FQDN values assigned to your URLs.

Get the subject names configured on the certificate assigned to the Exchange server
Get-ExchangeCertificate | where { $_.Services.ToString().Contains(“IIS”) –eq $true } | fl Cert*

Open in new window

Get the service connection point URL used by Outlook to locate the Autodiscover service
Get-ClientAccessServer CasServerName | fl AutoDiscoverServiceInternalUri

Open in new window

Get the Exchange Web Services URL values
Get-WebServicesVirtualDirectory | fl *Url

Open in new window

Get the Offline Address Book URL values
Get-OabVirtualDirectory | fl *Url

Open in new window

Get the Autodiscover URL values
Get-AutodiscoverVirtualDirectory | fl *Url

Open in new window

Get the Outlook Anywhere FQDN
Get-OutlookAnywhere | fl External*

Open in new window

Here is an example of results:
CertificateDomains :             {mail.contoso.com, autodiscover.contoso.com}
AutoDiscoverServiceInternalUri : https://mail.contoso.com/Autodiscover/Autodiscover.xml
InternalUrl :                    https://mail.contoso.com/EWS/Exchange.asmx
ExternalUrl :                    https://mail.contoso.com/EWS/Exchange.asmx
InternalUrl :                    http://mail.contoso.com/OAB
ExternalUrl :                    https://mail.contoso.com/OAB
InternalUrl :
ExternalUrl :
ExternalHostname :               mail.contoso.com

Open in new window

Note: The Autodiscover virtual directory results can be empty

If you need to update any of the Exchange settings you can run the following:
Set-ClientAccessServer CasSrv AutoDiscoverServiceInternalUri 
Set- WebServicesVirtualDirectory CasSrv\ews* -ExternalUrl –InternalUrl
Set- OabVirtualDirectory CasSrv\oab* -ExternalUrl –InternalUrl

Open in new window

Note: After each ExternalUrl and InternalUrl you need to include the appropriate URL value, use the format from your Get cmdlets as a guideline.

Next you need to verify your DNS records both internally and externally. There must be an A record on your internal DNS server for the FQDN value used in all of the InternalUrl values, the AutoDiscoverServiceInternalUri, and the ExternalHostname. You can use the nslookup utility to validate (nslookup autodiscover.contoso.com).

Your external DNS server records are dependent on your certificate domain names. Typically your certificate should include autodiscover.yourdomain.com and you should have an associated A record. If your certificate does not include autodiscover.yourdomain.com, then your DNS server must support SRV records. The SRV record should then be configured as follows:
Service = _autodiscover
Protocol = _tcp
Port = 443
Hostname = (a certificate domain name value = existing A record)

Open in new window

There are several web sites you can use to verify your external DNS records (http://www.dnsquery.org/).


Once your configuration is complete you can test your system externally using https://testexchangeconnectivity.com/
Test Remote Connectivity
You can test your system internally by opening Outlook, then using the combination of Right Ctrl and Right-click on the Outlook icon in the taskbar, and select Test E-mail AutoConfiguration. Your e-mail address should auto-populate. Remove the Guessmart options and press Test.
 Outlook Test E-Mail AutoConfiguration
Ask questions about what you read
If you have a question about something within an article, you can receive help directly from the article author. Experts Exchange article authors are available to answer questions and further the discussion.
Get 7 days free