Exchange 2013 certificate issues with Outlook Anywhere

Hello,

I am at my wits end with a certificate issue on a new Exchange 2013 installation. I installed a certificate from godaddy.com that works fine for Exchange ActiveSync and allows Outlook Anywhere access. The internal domain is domain.local and the certificate is setup for mail.domain.com. I created dns entries for mail.domain.com on the dns server and they resolve to the local email server. All internal and external addresses are set using https://mail.domain.com/.... within the Exchange Admin Center.

All users are receiving the following error when they open Outlook.

"There is a problem with the proxy server's security certificate. The name on the security certificate is invalid or does not match the name of the target site exchange-cal.domain.local. Outlook is unable to connect to the proxy server. (Error Code 10)"

They also receive a security alert stating the name on the security certificate is invalid or does not match the name of the site,

Outlook works fine, but users are complaining about the pop ups.

Is there a way to resolve the pop ups other than purchasing a san certificate? I understand that many certificate authorities will not issue certificates with domain.local internal domain names.

Thanks so much,
Steve
LVL 1
steve90ttzAsked:
Who is Participating?
 
Simon Butler (Sembee)Connect With a Mentor ConsultantCommented:
Internally you can get away without Autodiscover.example.com, because internal clients do not use it, unless you tell them to.
Externally you cannot, you need to cover Autodiscover some how.

If you have a single name SSL certificate, then use an SRV record for Autodiscover.
http://semb.ee/srv

Then configure the URLs internally to use the same external name.
The Exchange 2010 version of my article is fine for this: http://semb.ee/hostnames

Simon.
0
 
MAS EE MVETechnical Department HeadCommented:
Do you have autodiscover.domain.com added to the cert?

If yes Please post a screenshot of the error.
0
 
steve90ttzAuthor Commented:
Hello.

Thanks for the response. mail.domain.com and www.mail.domain.com are part of the certificate. autodiscover.domain.com is not part of the certificate. Should it be?


Thanks,
Steve
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
MAS EE MVEConnect With a Mentor Technical Department HeadCommented:
You should have autodiscover.domain.com as a SAN in your cert.
Add autodiscover.domain.com and reissue the cert and install it. Your error should disappear.

Please update us after adding and installing cert with autodiscover.domain.com.

Delete the old cert from server to make sure services are using new cert.

Do you have autodiscover.domain.com in your external DNS which points to external IP?
If not please create that as well
0
 
steve90ttzAuthor Commented:
Thanks for the help abbasiftt and Sembee2. I have made numerous changes and have been able to get the certificate error stating the name on the security certificate is invalid or does not match the name of the site. I am still having issues with the following error appearing when launching Outlook.

"There is a problem with the proxy server's security certificate. The name on the security certificate is invalid or does not match the name of the target site exchange-cal.domain.local. Outlook is unable to connect to the proxy server. (Error Code 10)"

I created the dns entries as mentioned in Sembee2's links. All internal and external urls from the exchange admin center, are pointing to the mail.domain.com that the certificate is assigned to. I processed a request for a new certificate with autodiscover.domain.com as well as mail.domain.com, but the new certificate only lists mail.domain.com.

Should the Microsoft Exchange Server Auth Certificate be removed from the certificate list? I believe it is created during installation? It is currently assigned to SMTP. There is also a WMSVC certificate that is not assigned to any services?

Thanks again,
Steve
0
 
MAS EE MVETechnical Department HeadCommented:
Enable services (IIS) on the new cert and restart exchange transport service and try.
http://technet.microsoft.com/en-us/library/aa997231(v=exchg.150).aspx
http://technet.microsoft.com/en-us/library/dd351257(v=exchg.141).aspx

This command will list you the installed certificates with thumbprint
Get-ExchangeCertificate
0
 
steve90ttzAuthor Commented:
Hello abbasiftt,

Thanks for your response. Sorry for my tardy response. I was away on holidays and didn't have a chance to try any changes until now.

I tried enabling the certificate using Exchange management shell for the smtp and IIS services. I restarted the exchange transport service and I am still getting the same error.

"There is a problem with the proxy server's security certificate. The name on the security certificate is invalid or does not match the name of the target site exchange-cal.domain.local. Outlook is unable to connect to the proxy server. (Error Code 10)"

Thanks again for all your assistance,
Steve
0
 
MAS EE MVETechnical Department HeadCommented:
Do you have autodiscover.domain.com added in to certificate?
If yes
Please make sure you enabled services to the new certificate
0
 
MAS EE MVETechnical Department HeadCommented:
check common name in th certificate as well
0
 
steve90ttzAuthor Commented:
Thanks so much for all of your help (and patience). You are truly an invaluable resource.

Thanks,
Steve
0
 
MAS EE MVETechnical Department HeadCommented:
Glad to help you again
0
 
TerellionCommented:
Hi there, I'm having the same issue as this. However we have an Exchange 2007 server in the mix aswell with autodiscover DNS record pointing to that server. I've put autodiscover in ours but getting the same error unfortunately. Anyone else had this too?

Thanks
0
 
MAS EE MVETechnical Department HeadCommented:
@Terellion
This is a closed question. You should ask this as a new question and post the URL here if you wish.
0
 
TerellionCommented:
0
All Courses

From novice to tech pro — start learning today.