Our Exchange server has been running with an internally signed certificate for a while. Today I bought a trusted SSL certificate (wilcard) and installed on the server.
The certificate is issued to *.example.no and gives no security exceptions when I access the web interface at
https://mail.example.no/owa from the web browser.
Now, when I open Outlook I get this certificate validation error. I've tried all the standard solutions provided, which mostly involved setting the external url as the internal url.
- Internal FQDN:
- External FQDN:
- Error message: There is a problem with the proxy server's security certificate. The name on the security certificate is invalid or does not match the name of the target site mx.example.local. Outlook is unable to connect to the proxy server. (Error Code 10)
What I did:
Set-WebServicesVirtualDirectory –Identity ‘mx\EWS (Default Web Site)’ –ExternalUrl https://mail.example.no/ews/exchange.asmx Set-WebServicesVirtualDirectory -Identity "mx\EWS (Default Web Site)" –InternalUrl https://mail.example.no/EWS/Exchange.asmx Set-OABVirtualDirectory -Identity “mx\OAB (Default Web Site)” -InternalURL https://mail.example.no/OAB Set-ActiveSyncVirtualDirectory -Identity “mx\Microsoft-Server-ActiveSync (Default Web Site)” -InternalURL https://mail.example.no/Microsoft-Server-Activesync Set-ClientAccessServer -Identity mx -AutodiscoverServiceInternalUri https://mail.example.no/autodiscover/autodiscover.xml
[PS] C:\>Get-WebServicesVirtualDirectory | Select InternalUrl, BasicAuthentication, ExternalUrl, Identity | Format-List InternalUrl : https://mail.example.no/ews/exchange.asmx BasicAuthentication : True ExternalUrl : https://mail.example.no/ews/exchange.asmx Identity : mx\EWS (Default Web Site) [PS] C:\>Get-OabVirtualDirectory | Select InternalUrl, ExternalUrl, Identity | Format-List InternalUrl : https://mail.example.no/oab ExternalUrl : https://mail.example.no/OAB Identity : mx\OAB (Default Web Site) [PS] C:\>Get-ActiveSyncVirtualDirectory | Select InternalUrl, ExternalUrl, Identity | Format-List InternalUrl : https://mail.example.no/Microsoft-Server-ActiveSync ExternalUrl : https://mail.example.no/Microsoft-Server-ActiveSync Identity : mx\Microsoft-Server-ActiveSync (Default Web Site) [PS] C:\>Get-ClientAccessServer | Select Fqdn, AutoDiscoverServiceInternalUri, Identity | Format-List Fqdn : mx.example.local AutoDiscoverServiceInternalUri : https://mail.example.no/autodiscover/autodiscover.xml Identity : mx
After that I have
- Recycled the IIS Application pool MSExchangeAutoDiscoverAppPool (that did not make the message go away so I ...)
- Restarted the entire mail server (that did not make the message go away either so I ...)
- Went into Control Panel -> Mail -> Email Accounts and chose Repair on my account (since I am making this post you might have guessed that this had no effect either)
- Flushed DNS of the client computer (in case the autodiscover URL was ignored)
- Repaired the email account once again
- Tried to edit the account and put the public FQDN, mail.example.no, as server address
- EDIT: Tried to delete and recreate the account. Deleted the entire mail profile, %AppData%\Local\Outlook and %AppData%\Local\Outlook folders. Still no success.
I am running out of ideas now... every site I have visited on the web suggests that I do what I just did and the result is expected to be just as my result....
UPDATE: One of my users cannot even log in with Outloook from their workstation. The account is OK (mail on mobile phone and web client works) but Outlook keeps repeating the password prompt and will not exit Offline mode.
UPDATE: Did a SSL check on Digicert website to see if the certificate is installed OK. The server passed all checks, only thing I was warned about was the use of SSL 3.0 protocol: Protocol Support TLS 1.1, TLS 1.0, SSL 3.0. SSL 3.0 is an outdated protocol version with known vulnerabilities.
Disclaimer: No real internal IP addresses were harmed making this update
- I set up a new Forward Lookup Zone in DNS,
mail.example.nowith one blank (A) record pointing to 192.168.1.1, the hypothetical IP address of the mail server
- In the Reverse Lookup Zone for 192.168.1.in-adds.arpa I have e (PTR) record named 192.168.1.1 pointing to mail.example.no
- Downloaded DigiCert® Internal Name Tool for Microsoft Exchange
- Ran the tool, the addresses were mostly correct but OWAVirtualDirectory ECPVirtualDirectory was still referring to mx.example.local so I changed them to mail.example.no
nslookup output looks promising:
D:\>ipconfig /flushdns Windows IP Configuration Successfully flushed the DNS Resolver Cache. D:\>nslookup mail.example.no Server: dc1.example.local Address: 192.168.1.2 Name: mail.example.no Address: 192.168.1.1 D:\>nslookup 192.168.1.1 Server: dc.example.local Address: 192.168.1.2 Name: mail.example.no Address: 192.168.1.1
Outlook does not.....
- Went to Account Settings -> More Settings -> Connection -> Exchange Proxy Settings.
- Changed the connection URL to
- Changed the allowed principal name to
- Restarted Outlook. The Certificate error does not pop up now but I notice that I am not connected...
- Account Settings once more, this time I chose automatic Repair
- Restarted Outlook
- Now, if I go back to Exchange Proxy settings the internal URL has returned...