MS Exchange 2007, Entourage 2008 and security certificate errors

Hi everyone,

Have got so far from a whole lot of help from the EE community - but this one has me stumped, as most of the SSL guides are written for Windows Server 2003...

I was running Exchange on Windows SBS 2003 and have [almost] successfully migrated to Exchange 2007 on Windows Server 2008. The SBS server always used a self-signed certificate, but I decided to go and get a proper UCC SSL certificate from GoDaddy to make Exchange 2007 work properly. I am using Entourage 2008 on Macs to connect to the Exchange server.

My DNS setup is as follows:
internal:
SBS - srv2.domain.lan
Ex2007 - srv3.domain.lan
external:
SBS - portal.domain.org
Ex2007 - exchange.domain.org

The UCC SSL certificate is registered to exchange.domain.org as the CN and then the following SANs:
autodiscover.domain.org
portal.domain.org
eesrv3.domain.lan
eesrv3

When I start Entourage, I get the following certificate errors:
"Unable to establish a secure connection to srv2.domain.lan because the server name or IP address does not match the name or IP address on the server's certificate." AND
"Unable to establish a secure connection to domain.org because the server name or IP address does not match the name or IP address on the server's certificate."
(note - Entourage DOES connect, and OWA works fine)

Questions:
1) why is it trying to reference SRV2 when the mailbox and Exchange should be running off SRV3?
2) why does it need to verify my root domain (domain.org) when SRV3 should be reachable at exchange.domain.org and srv3.domain.lan

Any thoughts anyone?

Thanks!