Outlook 2010 certificate issue after upgrading from Exchange 2003 to 2010

[dpowell1]

Just upgraded from 2003 to 2010 and all client workstations (Outlook 2010) are working fine. However, the Outlook instances on the profiles on our terminal server (server 2003) all throw the same error when we launch Outlook 2010:

"There is a problem with the proxy server's security certificate. The name on the certificate is invalid or does not match the name of the target site."

The certificate we installed on the new exchange server is a public certificate and the Microsoft Remote Connectivity Analyzer passes. Any ideas what might be causing this?

 

[dpowell1]

The other thing I'm noticing is that the message states that the target site name in the message is mail.xxx.com (actual domain name omitted) which is the proper name. When I look at my SAN certificate is lists the primary name as xxx.com but I also have mail.xxx.com listed as one of the names in the cert. Is it possible that my terminal server (server 2003) doesn't recognize the other names in the SAN cert and only sees the one name?

 

[dennylutz]

Try opening the OWA website directly from the terminal server. Do you get the security warning ? Take look at the certificate and see what issue is there. You can take a screenshot of the certificate info from terminal server and we can help you further.

It is possible that your terminal server doesnt trust the issued CA.

 

[dpowell1]

No warnings when launching OWA from the terminal server. Certificate can be viewed by going to

https://mail.klabin.com

 

[fuego007]

This may be a stupid question, but my motto is the only stupid questions are the ones that aren't asked. So, here goes: Have to enabled the certificate for Exchange? (enable-exchangecertificate -thumbnail xxxxxxxxxx -services IIS,SMTP, etc).

When all else fails, read the book!

 

[fuego007]

Please disregard my previous post. Sometimes it helps to read the original post carefully .

When all else fails, read the book!

 

[dennylutz]

Powell,

If OWA works without warnings on the terminal server, it must be some other namespace outlook is trying to connect to. Can you upload the screenshot of this error from Outlook ?

It looks like below are your subject alternative names. There's a good chance that the dns name outlook is trying to connect to is missing from this list.

DNS Name: klabin.com
DNS Name: mail.klabin.com
DNS Name: autodiscover.klabin.com
DNS Name: legacy.klabin.com

 

[dpowell1]

A link to the screen shot is attached. The really strange thing is that it references mail.klabin.com which is on the SAN cert. All of the other workstations work fine...it's just the terminal server profiles.

 

[ShackDaddy]

The basic problem is that the terminal server is using Outlook Anywhere (HTTP) to connect to the mail server, and Outlook Anywhere likes to have the name it connects to also be the subject name on the cert, not just an additional SAN (subject alternative name) like it is. The primary subject name on the cert is just "klabin.com" but if you look at the Outlook Proxy settings on one of those terminal server Outlook profiles, you'll see that the box is check to "only connect to servers that have this principle name in their certificate", and the MSSTD name is "mail.klabin.com". But that's not the common name on the cert, so you are seeing the error. Seems like it should look in the SAN list, but it doesn't.

You can basically do two things to get around this:

1. Change the primary name on your cert to mail.klabin.com, which it really should be (it should always be set to whatever you are going to use for Outlook Anywhere).

2. Disable MSSTD verification by unchecking that box. Or better yet, do it on the server like this:

Set-OutlookProvider EXPR -CertPrincipalName none

Read this article for some additional details around this:

http://ilantz.com/2011/02/08/authen...with-exchange-2007-2010-and-outlook-anywhere/

Dave Shackelford
ThirdTier.net
TrainSignal.com

 

[netometer]

Hi,

This problem has been fixed in Vista SP1 and later. The subject Common Name (CN) of your certificate - "klabin.com" does not match the name OA clients are connecting to (even though the name is listed in the SAN).

Instead of patching the issue, I would prefer to re-key the certificate (takes seconds) with the CN=mail.klabin.com. That way the clients will be happy, and the web server - klabin.com will be working fine with the certificate.

BTW, why don't you add

http://www.klabin.com

in the SAN? You can have at least 5 Subject Alternative Names in that certificate?


Dean

http://www.netometer.com/blog