Problem with site security certificate in Exchange 2010

Posted on 2013-12-25
Medium Priority
Last Modified: 2014-01-09
We have security certificate from trusted authority but now we are getting below error of certificate.

"The name on security certificate is invalid or does not mach the name of the site"

This error pops up frequently in outlook. Kindly assist for the same.
Question by:sanjayambre
LVL 10

Expert Comment

ID: 39739248
Can I assume you have a different internal (e.g. exchserv.lanname.local)and external (e.g. mail.domainname.com) server name for your exchange server?   Is that internal name on the certificate?

If this is your issue (answered yes & no above): here is a workaround - you can create a LOCAL dns entry on network to point the external name to your internal exchange server IP address.  (note this will NOT match what the internet says for the giving domain name- which will specify your WAN IP.)  You can then configure outlook using the external name and it will find the server and match the cert.
LVL 23

Expert Comment

by:Patrick Bogers
ID: 39739282

For this setup you need à SAN certificate (Subject Alternative Name) which contains your internal domain and your external domain.
LVL 31

Expert Comment

by:Gareth Gudger
ID: 39739500
Patrick, after 2015, internal names can no longer be used on SAN certificates.

So you are better off setting your Internal URLs to match your External URLs and then using split brain DNS, where you have a non-authoritative copy of your external DNS namespace on your internal DNS servers.
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.


Author Comment

ID: 39739692
Yes. we have different internal (e.g. exchserv.lanname.local)and external (e.g. mail.domainname.com) server name for exchange server. Error pops-up is related with internal server name.

Accepted Solution

vSolutionsIT earned 1200 total points
ID: 39739778
use your external domain name mentioned in the certificate and configure your exchange services as mentioned in below articles then check if you are still facing this issue.


LVL 31

Expert Comment

by:Gareth Gudger
ID: 39740567
Yep, just make your internal URLs match your external URLs in Exchange and use split brain DNS to create those external records to map to internal IPs.
LVL 10

Expert Comment

ID: 39741248
That's called "split-brain DNS"? LOL, love it!

Featured Post

Train for your Pen Testing Engineer Certification

Enroll today in this bundle of courses to gain experience in the logistics of pen testing, Linux fundamentals, vulnerability assessments, detecting live systems, and more! This series, valued at $3,000, is free for Premium members, Team Accounts, and Qualified Experts.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

This article describes Top 9 Exchange troubleshooting utilities that every Exchange Administrator should know. Most of the utilities are available free of cost. List of tools that I am going to explain in this article are:   Microsoft Remote Con…
The Exchange database may sometimes fail to mount owing to various technical reasons. A dismounted EDB file can be the source of many Exchange errors including mailbox inaccessibility for users. Resolving the root cause of mounting problems becomes …
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question