I've just installed Outlook 2013 and have all the clients connecting to it, however, whenever a client connects via outlook they are prompted with an invalid SSL message for myserver.mydomain.local. I have a wildcard certificate setup and assigned in IIS for *.example.com so I understand why the message appears but I am not exactly sure what to do about it and where to start looking without poking random things.

From the research I've done, I can see that this can be caused by the autodiscover service so I have changed the domain DNS records to not use an A record but instead use an SRV record inline with this Microsoft article. Should this be sorting the issue and I am just being impatient with propagation or am I barking up the wrong tree?

This post fixed the issue with an SRV record: Exchange 2013 SSL Warning in Outlook

Edit Interestingly running get-ClientAccessServer | ft identity,AutodiscoverServiceInternalUri shows my internal FQDN and not my external one which I assume is the issue. I am going to try changing this now.


Make sure the URL fit the certificate.

Issue those command via powershell to validate;

Get-ActiveSyncVirtualDirectory | fl internalurl,externalurl
Get-AutoDiscoverVirtualDirectory | fl internalurl,externalurl
Get-ECPVirtualDirectory | fl internalurl,externalurl
Get-OabVirtualDirectory | fl internalurl,externalurl
Get-WebServicesVirtualDirectory | fl internalurl,externalurl

Change them to make them match the certificate;

Get-ActiveSyncVirtualDirectory -server EXCHANGE | Set-ActiveSyncVirtualDirectory -ExternalUrl 'https://mail.example.com/Microsoft-Server-ActiveSync' -InternalUrl 'https://mail.example.com/Microsoft-Server-ActiveSync'
Get-AutodiscoverVirtualDirectory -server EXCHANGE | Set-AutodiscoverVirtualDirectory -ExternalUrl 'https://mail.example.com/Autodiscover/Autodiscover.xml' -InternalUrl 'https://mail.example.com/Autodiscover/Autodiscover.xml'
Get-ECPVirtualDirectory -server EXCHANGE | Set-ECPVirtualDirectory -ExternalUrl 'https://mail.example.com/ECP' -InternalUrl 'https://mail.example.com/ECP'
Get-OabVirtualDirectory -server EXCHANGE | Set-OabVirtualDirectory -ExternalUrl 'https://mail.example.com/OAB' -InternalUrl 'https://mail.example.com/OAB'
Get-WebServicesVirtualDirectory -server EXCHANGE | Set-WebServicesVirtualDirectory -ExternalUrl 'https://mail.example.com/EWS/Exchange.asmx' -InternalUrl 'https://mail.example.com/EWS/Exchange.asmx'

A example using the GUI there

  • I'll take a look at this now, many thanks. I'll report back. – webnoob Jan 9 '15 at 14:13
  • Two things: 1 - The autodiscover one has nothing set in it already, why would this be? 2 - Just to confirm, I'm even changing the internal ones to do an external lookup? – webnoob Jan 9 '15 at 14:15
  • I would do a split DNS setup, so internaly the mail.example.com will resolve to the internal IP, while user on the road will still get the public IP – yagmoth555 Jan 9 '15 at 14:17
  • Set it with the powershell listed above (for internalurl and external), as it will modify the IIS correctly. Do a iisreset too after – yagmoth555 Jan 9 '15 at 14:24
  • Ok, I've done as stated above and restarted IIS but I still get the SSL warning on outlook startup. Any ideas? – webnoob Jan 9 '15 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.