Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently having trouble with the last stage of configuring Exchange/Outlook in our organisation.

We are having issues with an SSL Warning when opening Outlook 2013, where it is failing to validate the SSL, as it is using our (old) Internal URL (exchange.internal.local).

Please see the config within Exchange below, however I'm not sure what is causing this, if it helps it doesn't seem to be happening in Outlook 2007

get-ClientAccessServer | ft identity,AutodiscoverServiceInternalUri
Identity                                                    InternalUrl
--------                                                    -----------
EXCHANGE\Autodiscover (Default Web Site)

get-webservicesvirtualdirectory | ft identity,internalurl
Identity                                                    AutoDiscoverServiceInternalUri
--------                                                    ------------------------------

get-webservicesvirtualdirectory | ft identity,internalurl
Identity                                                    InternalUrl
--------                                                    -----------
EXCHANGE\EWS (Default Web Site)                   

get-oabvirtualdirectory | ft identity,internalurl
Identity                                                    InternalUrl
--------                                                    -----------
EXCHANGE\OAB (Default Web Site)                   

get-owavirtualdirectory | ft identity,internalurl
Identity                                                    InternalUrl
--------                                                    -----------
EXCHANGE\owa (Default Web Site)                   

get-ecpvirtualdirectory | ft identity,internalurl
Identity                                                    InternalUrl
--------                                                    -----------
EXCHANGE\ecp (Default Web Site)                   

get-ActiveSyncVirtualDirectory | ft identity,internalurl
Identity                                                    InternalUrl
--------                                                    -----------
EXCHANGE\Microsoft-Server-ActiveSync (Default Web Site)

RunspaceId                         : 416632a3-3695-430f-8d49-a072344e2bc0
ServerName                         : EXCHANGE
SSLOffloading                      : True
ExternalHostname                   :
InternalHostname                   :
ExternalClientAuthenticationMethod : Negotiate
InternalClientAuthenticationMethod : Ntlm
IISAuthenticationMethods           : {Basic, Ntlm, Negotiate}
XropUrl                            :
ExternalClientsRequireSsl          : True
InternalClientsRequireSsl          : True
MetabasePath                       : IIS://EXCHANGE.internal.local/W3SVC/1/ROOT/Rpc
Path                               : C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\rpc
ExtendedProtectionTokenChecking    : None
ExtendedProtectionFlags            : {}
ExtendedProtectionSPNList          : {}
AdminDisplayVersion                : Version 15.0 (Build 516.32)
Server                             : EXCHANGE
AdminDisplayName                   :
ExchangeVersion                    : 0.20 (
Name                               : Rpc (Default Web Site)
DistinguishedName                  : CN=Rpc (Default Web Site),CN=HTTP,CN=Protocols,CN=EXCHANGE,CN=Servers,CN=Exchange
                                     Administrative Group (FYDIBOHF23SPDLT),CN=Administrative
Identity                           : EXCHANGE\Rpc (Default Web Site)
Guid                               : 7a9f693d-0f42-4fd5-8de9-e3e7eb946932
ObjectCategory                     : internal.local/Configuration/Schema/ms-Exch-Rpc-Http-Virtual-Directory
ObjectClass                        : {top, msExchVirtualDirectory, msExchRpcHttpVirtualDirectory}
WhenChanged                        : 26/06/2013 11:31:19
WhenCreated                        : 21/06/2013 14:37:47
WhenChangedUTC                     : 26/06/2013 10:31:19
WhenCreatedUTC                     : 21/06/2013 13:37:47
OrganizationId                     :
OriginatingServer                  : Exchange.internal.local
IsValid                            : True
ObjectState                        : Changed

Thumbprint                                Services   Subject
----------                                --------   -------
239AA8CC6811F0D226F73959B3B4D61FFADDF694  IP.WS.., OU=Domain Control Validated

Screenshot of the error


!!EDIT!! Also if it helps, running the Exchange through Test Exchange Connectivity reveals the following: Screenshot

share|improve this question
Check Get-OutlookAnywhere. It has an InternalHostname and ExternalHostname now that wasn't present in 2010. – Jeremy Lyons Jul 4 '13 at 21:33
@JeremyLyons Thanks for the heads up, all looks OK, but I have added the output to the above post – Matt Clements Jul 5 '13 at 10:21
It looks like you're presenting the wrong Exchange certificate. Did you install an Exchange certificate for and Did you assign services to it after installing it? – Jeremy Lyons Jul 5 '13 at 20:56
@JeremyLyons The SSL being presented is for but does not cover - this SSL is the only SSL now in Exchange (all others have been deleted), could it be as doesn't have a valid SSL? I don't mind the initial warning for when setting up a mailbox. – Matt Clements Jul 7 '13 at 7:52
I'm still confused as to why Exchange seems to be presenting a cert for exchange.domain.local. Can you give me a sanitized output of get-exchangecertificate? Also, using that website to test from outside isn't a 1:1 test, but they have a downloadable tool you can run from your workstation that I would recommend trying. – Jeremy Lyons Jul 10 '13 at 2:33
up vote 0 down vote accepted

Ok - Changing the Autodiscover from a DNS A Record to an SRV Record fixed.

Also this was still popping up on the Test Machines which were already setup.

On deleting/re-adding the Exchange Accounts to Outlook this fixed.

share|improve this answer
Just to advise you that the approach above is the default. Your approach is more suitable for External access to the Exchange server through Outlook Anywhere connectivity. – Vick Vega May 9 '14 at 0:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.