We have Exchange 2010 deployed with Outlook Anywhere. People connect with Outlook to the external hostname (mail.example.com) through RCP/HTTP.

It works fine for people outside of the office but when people are inside the office, the Outlook client connects to the NETBIOS name of the server (ex.example.com) and this generates an SSL cert warning since we do not have a cert for the NETBIOS name.

How do I resolve this? I assume I need to install a cert for this server which will be trusted by our Windows domain, but I don't know how to do this.



I see two ways to fix this:

  1. Get a UC/SAN certificate for both the internal and the external name


  1. Configure the internal Outlook clients to connect via RPC over HTTP with the same settings that the external clients use and configure Outlook to connect via HTTP over Fast AND Slow networks.

When Outlook connects via MAPI or Outlook Anywhere using TCP it will look for the Service Connection Point for the CAS server in Active Directory and find the internal server name, which doesn't match your certificate. Configuring Outlook to connect using RPC over HTTP via HTTP only will cause Outlook to connect via the external server name, which does match your certificate.

  • I knew that I could fix it by adding the internal hostname to the UCC but I thought maybe that was unsafe. What are your thoughts on this? – blizz Jul 22 '13 at 19:07
  • BTW can I just add a certificate for the internal hostname and make it trusted by all users in the domain? – blizz Jul 22 '13 at 19:14
  • I don't believe so. That would break external clients. AFAIK, only one certificate can be bound to the CAS role and that certificate should have both the internal and external server names, hence the need for a UC/SAN certificate. You can use wildcard certificates but I have no first-hand experience using them with Exchange Server 2010. – joeqwerty Jul 22 '13 at 21:26
  • I'd recommend the second solution as well - using the same URL for internal and external access. I never assign more than just owa.domain.com and autodiscover.domain.com to my UC certificates. Using autodiscover on additional domains can be handled with SRV records. – Jeremy Lyons Jul 23 '13 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.