Solved

SSL Cert Popup during Exchange Migration

Posted on 2016-09-19
7
45 Views
Last Modified: 2016-09-26
We are migrating a customer currently using exchange on a server that acts as their DC and houses AD.  We are migrating them to a hosted exchange system provided by us.  The problem is when we configure the new profiles in outlook with the new mailboxes, we get an autodiscover certificate popup that appears to come from the old server.  
"The name on the security certificate is invalid or does not match the name of the site."
The issued to and by state the old server name.

The certificate popup includes a .local SAN


Is there a way to alleviate this or turn of the cert within the eac on the old server to stop it from happening?
0
Comment
Question by:johnpatbullock
  • 4
  • 3
7 Comments
 
LVL 15

Accepted Solution

by:
Ivan earned 500 total points
Comment Utility
Hello,

since the client has Exchange in-house, as soon as you configure Outlook, it is going to pull autodiscover information via SCP (from AD), and that is going to point to old exchange.

You can check autodiscover configuration via:
Get-ClientAccessService | Select AutodiscoverServiceInternalUri
or
Get-ClientAccessServer | Select AutodiscoverServiceInternalUri

It is going to be something like https://OLDservername.domain.com/autodiscover/autodiscover.xml

You could disable it via:
(For Exchange 2016)
[PS] C:\> Set-ClientAccessService -Identity “OLDservername” -AutoDiscoverServiceInternalUri $NULL
or
(For Exchange 2010-2013)
[PS] C:\> Set-ClientAccessServer -Identity “OLDservername” -AutoDiscoverServiceInternalUri $NULL

OLDservername is NetBIOS, not FQDN.

Did you reconfigure DNS so that autodiscover.domain.name is pointing to new Exchange?
Hosted Exchange is what version? Are you manually creating profiles or is autodiscover doing this for you?

PS: Is this happening both for internal and external clients?

Regards,
Ivan.
1
 

Author Comment

by:johnpatbullock
Comment Utility
I tried to disable the autodiscover service earlier by using that command you gave me and it didnt appear to do anything.  I did this on the old in house server.

However I did just find an autodiscover entry in the internal dns on the old server.  Could that be doing it?
0
 
LVL 15

Assisted Solution

by:Ivan
Ivan earned 500 total points
Comment Utility
Hi,

if autodiscover servis is disabled (this will be queried first), then if you have DNS record for autodiscover it will be queried after. So, yes, that is going to point your clients to old server.

If you run command below, it should return empty value. That will be sign that service is disabled, and that DNS record is pointing clients to old server.
Get-ClientAccessService | Select AutodiscoverServiceInternalUri
 or
 Get-ClientAccessServer | Select AutodiscoverServiceInternalUri

Regards,
Ivan.
1
Are your corporate email signatures appalling?

Is it scary how unprofessional your email signatures look? Do users create their own terrible designs and give themselves stupid job titles? You can make this a lot easier for yourself by choosing an email signature management solution from Exclaimer today.

 

Author Comment

by:johnpatbullock
Comment Utility
it gave me a

AutoDiscoverServiceInternalUri
_________________________________
0
 
LVL 15

Assisted Solution

by:Ivan
Ivan earned 500 total points
Comment Utility
Yes, that means it is disabled.
Reconfigure DNS to point to your new Exchange.

If you remove it, then Outlook 2016 will not be able to connect, as it is using autodiscover.
0
 

Author Comment

by:johnpatbullock
Comment Utility
Thank you for the help Ivan, It did end up being the internal DNS on the old server that was the issue.  Changed the autodiscover values in there and the problem went away!  

Thanks!
0
 
LVL 15

Expert Comment

by:Ivan
Comment Utility
You are welcome :)
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
This process describes the steps required to Import and Export data from and to .pst files using Exchange 2010. We can use these steps to export data from a user to a .pst file, import data back to the same or a different user, or even import data t…
In this video we show how to create a Contact in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Contact ta…
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now