?
Solved

SSL Cert Popup during Exchange Migration

Posted on 2016-09-19
7
Medium Priority
?
107 Views
Last Modified: 2016-09-26
We are migrating a customer currently using exchange on a server that acts as their DC and houses AD.  We are migrating them to a hosted exchange system provided by us.  The problem is when we configure the new profiles in outlook with the new mailboxes, we get an autodiscover certificate popup that appears to come from the old server.  
"The name on the security certificate is invalid or does not match the name of the site."
The issued to and by state the old server name.

The certificate popup includes a .local SAN


Is there a way to alleviate this or turn of the cert within the eac on the old server to stop it from happening?
0
Comment
Question by:johnpatbullock
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 17

Accepted Solution

by:
Ivan earned 2000 total points
ID: 41805539
Hello,

since the client has Exchange in-house, as soon as you configure Outlook, it is going to pull autodiscover information via SCP (from AD), and that is going to point to old exchange.

You can check autodiscover configuration via:
Get-ClientAccessService | Select AutodiscoverServiceInternalUri
or
Get-ClientAccessServer | Select AutodiscoverServiceInternalUri

It is going to be something like https://OLDservername.domain.com/autodiscover/autodiscover.xml

You could disable it via:
(For Exchange 2016)
[PS] C:\> Set-ClientAccessService -Identity “OLDservername” -AutoDiscoverServiceInternalUri $NULL
or
(For Exchange 2010-2013)
[PS] C:\> Set-ClientAccessServer -Identity “OLDservername” -AutoDiscoverServiceInternalUri $NULL

OLDservername is NetBIOS, not FQDN.

Did you reconfigure DNS so that autodiscover.domain.name is pointing to new Exchange?
Hosted Exchange is what version? Are you manually creating profiles or is autodiscover doing this for you?

PS: Is this happening both for internal and external clients?

Regards,
Ivan.
1
 

Author Comment

by:johnpatbullock
ID: 41805550
I tried to disable the autodiscover service earlier by using that command you gave me and it didnt appear to do anything.  I did this on the old in house server.

However I did just find an autodiscover entry in the internal dns on the old server.  Could that be doing it?
0
 
LVL 17

Assisted Solution

by:Ivan
Ivan earned 2000 total points
ID: 41805558
Hi,

if autodiscover servis is disabled (this will be queried first), then if you have DNS record for autodiscover it will be queried after. So, yes, that is going to point your clients to old server.

If you run command below, it should return empty value. That will be sign that service is disabled, and that DNS record is pointing clients to old server.
Get-ClientAccessService | Select AutodiscoverServiceInternalUri
 or
 Get-ClientAccessServer | Select AutodiscoverServiceInternalUri

Regards,
Ivan.
1
Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 

Author Comment

by:johnpatbullock
ID: 41805620
it gave me a

AutoDiscoverServiceInternalUri
_________________________________
0
 
LVL 17

Assisted Solution

by:Ivan
Ivan earned 2000 total points
ID: 41805627
Yes, that means it is disabled.
Reconfigure DNS to point to your new Exchange.

If you remove it, then Outlook 2016 will not be able to connect, as it is using autodiscover.
0
 

Author Comment

by:johnpatbullock
ID: 41816095
Thank you for the help Ivan, It did end up being the internal DNS on the old server that was the issue.  Changed the autodiscover values in there and the problem went away!  

Thanks!
0
 
LVL 17

Expert Comment

by:Ivan
ID: 41816207
You are welcome :)
0

Featured Post

Introducing the WatchGuard 420 Access Point

WatchGuard's newest access point includes an 802.11ac Wave 2 chipset, providing the fastest speeds for VoIP, video and music streaming, and large data file transfers. Additionally, enjoy the benefits of strong security as the 3rd radio delivers dedicated WIPS protection!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In-place Upgrading Dirsync to Azure AD Connect
Want to know how to use Exchange Server Eseutil command? Go through this article as it gives you the know-how.
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question