Autodiscover in Exchange 2010 and Outlook 2010 - Certification Warning

[WBO]

Hello,



I´ve got an Autodiscover error that is being difficult to sort out.Here the scenario: I have Exchange 2010, Enterprise edition servers deployed on Windows 2008 R2 Enterprise. I got 2 CAS servers with only CAS role intalled on them in Windows NLB with CAS Array configuration. No Certificates installed. All Ports are open on NLB. NLB name is "nlbcas.smpn.net". Cas array name is "casarraysitea", FQDN is "casarraysitea.smpn.net" Site Name is "SiteA". CAS servers names are - SRPAPXCH03 and SRPAPXCH04. There are 2 Mailbox servers in a DAG configuration, installed in 2 separate servers with roles Mailbox, HUB and UM.



When I open Outlook 2010 I get this message:  "The security certificate was issued by a company you have not chosen to trust. View the certificate to determine wether you want to trust the certifying authority". Then the user have to click on the "OK" button to proceed and then access his mailbox.



The name that was being shown was the NLB name: I changed that name to the CAS Array Name and the same error happend.Then I used the following commands do set the autodiscover to the individual CAS server names:



Set-ClientAccessServer -identity srpapxch03 -AutodiscoverServiceInternalUri "https://srpapxch03.smpn.net/Autodiscover/Autodiscover.xml"



Set-ClientAccessServer -identity srpapxch04 -AutodiscoverServiceInternalUri "https://srpapxch04.smpn.net/Autodiscover/Autodiscover.xml"



EWS and OAB were configured the same way, to their respective CAS server names. Am I missing an internal CA authority, or there is a powershell command that gets rid of this error?



I really need help with ths..



Thanks!



WBO

[AndyD_ [MVP]]

Are these domain-joined workstations that are getting the certificate error? The self-signed Exchange certificate is installed by default. Is that the cert its referring to?



 

[Em0]

Please attach the information from the certificate warning in outlook..



 



From what you describe it seems like you are using the self signed cerificate that is installed by default.. Either install a CA in you domain and issue a certificate to you client access servers OR buy a certificate from an online authoroty... 



 



 

[Ramy Messiha]

Hello



Even if with a self-signed certificate , Outlook should not prompt the user for certifcate trust, this is hard-coded in Outlook with self-signed certificates. Also changing the names will not resolve your problem because it is trust error. If you have a standalone certification authority, you have to import the certificate of your CA to all your users, or consider to purchase a commercial certificate that is trusted by all computers by default.



Thanks, 

[Brian Desmond -MVP-]

Even if with a self-signed certificate , Outlook should not prompt the user for certifcate trust, this is hard-coded in Outlook with self-signed certificates.

No I don't think so...
Active Directory, 4th Edition - www.briandesmond.com/ad4/

[AndyD_ [MVP]]

Yep, Outlook should trust the Exchange self-signed cert. However, I have heard of people claiming that Outlook 2010 sometimes throws this error when accessing the Exchange self-signed cert. Havent seen or tested however.



 

[AndyD_ [MVP]]

http://blogs.msexchange.org/walther/...-outlook-2010/



Certificate warning when using a self-signed Exchange certficate and Outlook 2010



 



Not sure if this applies in this situation.



 



 

[Ramy Messiha]

According to this article, beginning Outlook 2010 , users get warnnings about self-signed certificate. This was no the case with Exchange 2007 & Outlook 2007



Reference is Autodiscover whitepaper on TechNet

[AndyD_ [MVP]]

Yep, thats what the article says. Since the poster is using Outlook 2010, it may apply.



 

[WBO]

Thanks Andy,



Yeah, the article clarifies the whole thing, the MS outlook team decided that from now on we have to either setup an internal CA or buy a SAN certificate from a trusted, public CA.



Thanks for your help, now we know we need to include a CA Design into our projects to avoid this warning pop-up, as it is really frustrating.



Thanks again,



WBO.