Solved

AutoDiscover Certificate gives warning error from computers outside the network

Posted on 2010-09-15
3
871 Views
Last Modified: 2012-06-21
I'm running Exchange 2007.  When Outlook users from outside our network open Outlook they receive a certificate warning.  It says that the certificate is valid and trusted, but "the name of the security certificate is invalid or does not match the name of the site".  I have two CAS servers configured with NLB.  My certificates has 3 names, cas1.domain.edu, cas2,domain.edu, jointname.domain.edu.  In DNS,  the autodiscover alias points to jointname.domain.edu.  I assume the warning is because it tries to use autodiscover.domain.edu and this isn't an actual altername name.  I've tried adding an SRV records per article:
http://support.microsoft.com/kb/940881, but it doesn't change anything.  I assume that is because the original attempt doesn't outright fail so that is tries the SRV record.  Aside from buying new certificates, doesn't anyone know how to make the warning go away. Outlook inside my network works fine - as does OWA.  This is specifcally related to Outlook Anywhere.
My test client is Outlook 2007, and think it will suffice to alleviate the warning just for Outlook 2007 if that is possible.
Thanks.
0
Comment
Question by:apsutechteam
3 Comments
 
LVL 32

Accepted Solution

by:
endital1097 earned 167 total points
ID: 33687194
0
 
LVL 19

Assisted Solution

by:R--R
R--R earned 166 total points
ID: 33687261
0
 
LVL 58

Assisted Solution

by:tigermatt
tigermatt earned 167 total points
ID: 33687425

The problem is indeed your SSL certificate.

The underlying DNS infrastructure which maps autodiscover to jointname has no relevance when it comes to certificate trust. As far as Outlook and the cryptography system is concerned, the connection is to autodiscover.domain.edu so that name MUST be listed on the certificate.

If you create a SRV record to map to your jointname.domain.edu, you need to remove the old CNAME and allow time for the changes to propagate through DNS. Outlook only resorts to SRV records if conventional autodiscover.domain.edu fails, and it must be Outlook SP1 or higher.

I personally do not like the SRV record approach. Your public DNS provider must support it (many don't) and for the cost, it's much easier to replace the certificates.

-Matt
0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

We are happy to announce a brand new addition to our line of acclaimed email signature management products – CodeTwo Email Signatures for Office 365.
Find out what you should include to make the best professional email signature for your organization.
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question