You may experience certificate warning when using OWA and Outlook after you installed wild card certificate in your exchange organization. There are resolution available if you bing. Examples:
Certificate error message when you start Outlook or create an Outlook profile
SSL/TLS communication problems after you install KB 931125
“The name on the security certificate is invalid or does not match the name of the site”
This certificate with thumbprint 855951C368ECA4FF16AAAA82298E81B3F001BDED and subject ‘*.domain.com’ cannot used for IMAP SSL/TLS connections because the subject is not a Fully Qualified Domain Name (FQDN). Use command Set-IMAPSettings to set X509CertificateName to the FQDN of the service.
This certificate with thumbprint 855951C368ECA4FF16A33D82298E81B3F001BDED and subject ‘*.domain.com’ cannot used for POP SSL/TLS connections because the subject is not a Fully Qualified Domain Name (FQDN). Use command Set-POPSettings to set X509CertificateName to the FQDN of the service.
But root cause is not addressed in these articles. You are using wild card certificate *.domain.com or incorrect certificate SAN in Exchange server. You have to configure autodiscover, owa and oab correctly to address these issues. If you are using incorrect SAN then you have to regenerate CSR, re-issue certificate and reconfigure Exchange certificate in Exchange EAC.
Check DNS record. You must have the following DNS record internally and externally for autodiscover to function correctly
Internal record
If your internal domain is domain.local then you must create a DNS zone with domain.com in your DNS server. DNS must be set to round-robin.
| EX2013A.domain.com | 10.143.8.x | Host (A) |
| EX2013B.domain.com | 10.143.8.y | Host (A) |
| Mail.domain.com | 10.143.8.z | CNAME |
| Autodiscover.domain.com | 10.143.8.z | CNAME |
External Record
| Domain.com | 203.17.18.x | Host A |
| mx.Domain.com | 203.17.18.x | MX (lowest priority) |
| Mail.domain.com | 203.17.18.x | CNAME |
| Autodiscover.domain.com | 203.17.18.x | CNAME |
Let’s assume you have imported certificates in Exchange Administration Center. Now go to Exchange EAC>Click Servers>Click Certificates>Select Wild card certificate>Click Edit (Pen)>Services>Select IIS and SMTP>Click Save.
Now Open Exchange Management Shell using run as administrator. Copy the following cmdlets and amend per your domain and run these command.
Step1: Setup OWA
Set-OwaVirtualDirectory –Identity “ServerName\owa (Default Web Site)” –InternalUrl https://mail.domain.com/owa –ExternalURL https://mail.domain.com/owa
Setp2: Setup ActiveSync
Set-ActiveSyncVirtualDirectory –Identity “ServerName\Microsoft-Server-ActiveSync (Default Web Site)” –InternalURL https://mail.domain.com/Microsoft-Server-ActiveSync –ExternalURL https://mail.domain.com/Microsoft-Server-ActiveSync
Step3: Setup Outlook Anywhere
Set-OutlookAnywhere –Identity “ServerName\Rpc (Default Web Site)” –InternalHostname mail.domain.com –ExternalHostName mail.domain.com –ExternalClientAuthenticationMethod Basic –IISAuthenticationMethods Basic,NTLM
OR
Set-OutlookAnywhere –Identity “ServerName\Rpc (Default Web Site)” –InternalHostname mail.domain.com –ExternalHostName mail.domain.com
Set-OutlookAnywhere –Identity “ServerName\Rpc (Default Web Site)” –ExternalClientAuthenticationMethod Basic
Set-OutlookAnywhere –Identity “ServerName\Rpc (Default Web Site)” –IISAuthenticationMethods Basic,NTLM
Step4: Setup Web Services Virtual Directory
Set-WebServicesVirtualDirectory –Identity “ServerName\EWS (Default Web Site)” –InternalURL https://mail.domain.com/EWS/Exchange.asmx –ExternalURL https://mail.domain.com/EWS/Exchange.asmx -BasicAuthentication $true
Step5: Setup Client Access URL
Set-ClientAccessServer –Identity ServerName –AutoDiscoverServiceInternalUri https://mail.domain.com/Autodiscover/Autodiscover.xml
OR depending on DNS record
Set-ClientAccessServer –Identity ServerName –AutoDiscoverServiceInternalUri https://autodiscover.domain.com/Autodiscover/Autodiscover.xml
Step6: Setup ECP URL
Set-EcpVirtualDirectory –Identity “ServerName\ecp (Default Web Site)” –InternalURL https://mail.domain.com/ecp –ExternalURL https://mail.domain.com/ecp
Step7: Setup OAB
Set-OabVirtualDirectory -Identity “SERVERNAME\OAB (Default Web Site)” -ExternalUrl https://mail.domain.com/OAB
Step8: Setup Certificate principal name for outlook
Set-OutlookProvider EXCH -CertPrincipalName msstd:*.domain.com
Step9: Setup POP and IMAP with FQDN/CNAME of Mail Server
set-POPSettings -X509CertificateName mail.domain.com
set-IMAPSettings -X509CertificateName mail.domain.com
Now validate your settings. Issue the following cmdlets and checks FQDN and URLs are correct as issued earlier.
Get-WebServicesVirtualDirectory | Select InternalUrl, BasicAuthentication, ExternalUrl, Identity | Format-List
Get-OabVirtualDirectory | Select InternalUrl, ExternalUrl, Identity | Format-List
Get-ActiveSyncVirtualDirectory | Select InternalUrl, ExternalUrl, Identity | Format-List
Get-ClientAccessServer | Select Fqdn, AutoDiscoverServiceInternalUri, Identity | Format-List
Now Recycle App Pool. Open IIS Manager>Expand Application Pool>Select MSExchangeAutoDiscoverAppPool>Right Click and Recycle
Reboot exchange Server or issue iisreset command in exchange server to restart services. I have restarted my server. I will prefer a restart after these modifications.
Client side test.
- Delete outlook profile
- Make sure you use autodiscover to configure mail client
- Do not manually configure outlook
- Close IE. Reopen OWA and test OWA.
Last but not least update all exchange servers to latest Microsoft Windows Patch, Exchange Service pack and Exchange roll ups.
