Improve company productivity with a Business Account.Sign Up

x
?
Solved

Exchange 2013 certificate issues with Outlook Anywhere

Posted on 2013-10-27
14
Medium Priority
?
18,768 Views
Last Modified: 2014-07-17
Hello,

I am at my wits end with a certificate issue on a new Exchange 2013 installation. I installed a certificate from godaddy.com that works fine for Exchange ActiveSync and allows Outlook Anywhere access. The internal domain is domain.local and the certificate is setup for mail.domain.com. I created dns entries for mail.domain.com on the dns server and they resolve to the local email server. All internal and external addresses are set using https://mail.domain.com/.... within the Exchange Admin Center.

All users are receiving the following error when they open Outlook.

"There is a problem with the proxy server's security certificate. The name on the security certificate is invalid or does not match the name of the target site exchange-cal.domain.local. Outlook is unable to connect to the proxy server. (Error Code 10)"

They also receive a security alert stating the name on the security certificate is invalid or does not match the name of the site,

Outlook works fine, but users are complaining about the pop ups.

Is there a way to resolve the pop ups other than purchasing a san certificate? I understand that many certificate authorities will not issue certificates with domain.local internal domain names.

Thanks so much,
Steve
0
Comment
Question by:steve90ttz
  • 7
  • 4
  • 2
  • +1
14 Comments
 
LVL 29

Expert Comment

by:MAS (MVE)
ID: 39604816
Do you have autodiscover.domain.com added to the cert?

If yes Please post a screenshot of the error.
0
 
LVL 1

Author Comment

by:steve90ttz
ID: 39604820
Hello.

Thanks for the response. mail.domain.com and www.mail.domain.com are part of the certificate. autodiscover.domain.com is not part of the certificate. Should it be?


Thanks,
Steve
0
 
LVL 29

Assisted Solution

by:MAS (MVE)
MAS (MVE) earned 1000 total points
ID: 39604824
You should have autodiscover.domain.com as a SAN in your cert.
Add autodiscover.domain.com and reissue the cert and install it. Your error should disappear.

Please update us after adding and installing cert with autodiscover.domain.com.

Delete the old cert from server to make sure services are using new cert.

Do you have autodiscover.domain.com in your external DNS which points to external IP?
If not please create that as well
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 1000 total points
ID: 39606105
Internally you can get away without Autodiscover.example.com, because internal clients do not use it, unless you tell them to.
Externally you cannot, you need to cover Autodiscover some how.

If you have a single name SSL certificate, then use an SRV record for Autodiscover.
http://semb.ee/srv

Then configure the URLs internally to use the same external name.
The Exchange 2010 version of my article is fine for this: http://semb.ee/hostnames

Simon.
0
 
LVL 1

Author Comment

by:steve90ttz
ID: 39612050
Thanks for the help abbasiftt and Sembee2. I have made numerous changes and have been able to get the certificate error stating the name on the security certificate is invalid or does not match the name of the site. I am still having issues with the following error appearing when launching Outlook.

"There is a problem with the proxy server's security certificate. The name on the security certificate is invalid or does not match the name of the target site exchange-cal.domain.local. Outlook is unable to connect to the proxy server. (Error Code 10)"

I created the dns entries as mentioned in Sembee2's links. All internal and external urls from the exchange admin center, are pointing to the mail.domain.com that the certificate is assigned to. I processed a request for a new certificate with autodiscover.domain.com as well as mail.domain.com, but the new certificate only lists mail.domain.com.

Should the Microsoft Exchange Server Auth Certificate be removed from the certificate list? I believe it is created during installation? It is currently assigned to SMTP. There is also a WMSVC certificate that is not assigned to any services?

Thanks again,
Steve
0
 
LVL 29

Expert Comment

by:MAS (MVE)
ID: 39613374
Enable services (IIS) on the new cert and restart exchange transport service and try.
http://technet.microsoft.com/en-us/library/aa997231(v=exchg.150).aspx
http://technet.microsoft.com/en-us/library/dd351257(v=exchg.141).aspx

This command will list you the installed certificates with thumbprint
Get-ExchangeCertificate
0
 
LVL 1

Author Comment

by:steve90ttz
ID: 39670925
Hello abbasiftt,

Thanks for your response. Sorry for my tardy response. I was away on holidays and didn't have a chance to try any changes until now.

I tried enabling the certificate using Exchange management shell for the smtp and IIS services. I restarted the exchange transport service and I am still getting the same error.

"There is a problem with the proxy server's security certificate. The name on the security certificate is invalid or does not match the name of the target site exchange-cal.domain.local. Outlook is unable to connect to the proxy server. (Error Code 10)"

Thanks again for all your assistance,
Steve
0
 
LVL 29

Expert Comment

by:MAS (MVE)
ID: 39670973
Do you have autodiscover.domain.com added in to certificate?
If yes
Please make sure you enabled services to the new certificate
0
 
LVL 29

Expert Comment

by:MAS (MVE)
ID: 39670974
check common name in th certificate as well
0
 
LVL 1

Author Closing Comment

by:steve90ttz
ID: 39687618
Thanks so much for all of your help (and patience). You are truly an invaluable resource.

Thanks,
Steve
0
 
LVL 29

Expert Comment

by:MAS (MVE)
ID: 39687859
Glad to help you again
0
 

Expert Comment

by:Terellion
ID: 40202160
Hi there, I'm having the same issue as this. However we have an Exchange 2007 server in the mix aswell with autodiscover DNS record pointing to that server. I've put autodiscover in ours but getting the same error unfortunately. Anyone else had this too?

Thanks
0
 
LVL 29

Expert Comment

by:MAS (MVE)
ID: 40202217
@Terellion
This is a closed question. You should ask this as a new question and post the URL here if you wish.
0

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

In an Exchange Crossforest migration, the distribution groups can be a very complex operation that would cause loss of time, lots of issues and continued headaches if not solved in a timely manner. I had to do a similar project so I created a sc…
Using Granular Exchange Recovery Software to recover specific items from corrupt Exchange mailboxes. With Granular recovery techniques,  repair exchange mailbox and then move single items objects stored in Exchange EDB Files such as emails, contacts…
This video shows how to quickly and easily deploy an email signature for all users in Office 365 and prevent it from being added to replies and forwards. (the resulting signature is applied on the server level in Exchange Online) The email signat…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

606 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question