A Windows System Admin's Blog

Covering Server Administration, Endpoint Management, Scripting and Network Management

Security warning when you start Outlook 2007 and then connect to a mailbox that is hosted on a server that is running Exchange Server 2007 or Exchange Server 2010: “The name on the security certificate is invalid or does not match the name of the site”

, ,

I recently setup a SBS 2011 server for one of my clients. For several reasons we changed the external name to reach the server so instead of remote.fdqn.com.au it would be exchange.fqdn.com.au this worked perfectly once DNS settings propagated and allowed employees to connect externally via webmail or Outlook Anywhere (one of the best features in exchange/outlook hands down).  One issue which popped up after we installed the certificate for this new domain is that it was assigned to a different domain than what was configured in Exchange 2010, so internally clients would get security pop-ups everytime they would open their outlook.

The fix requires the use of the Exchange PowerShell Console, so fire it up. Once it loads, we first need to know what the name of our client access server is (for sites with multiple CAS servers you need to use this on the server doing your auto-discovery). So run Get-ClientAccessServer which will list all of the available CAS servers, for this instance it is SBSSERVER. So now that we have a list of servers and we know which is doing the auto-discovery we need to re-configure it to the new DNS entry.  Microsoft documentation doesn’t have ” ” quotation marks but it is important to have. So now run Set-ClientAccessServer with the following
Set-ClientAccessServer -Identity "SBSSERVER" -AutoDiscoverServiceInternalUri "https://exchange.fqdn.com.au/autodiscover/autodiscover.xml" with SBSSERVER being your CAS server and fqdn.com.au being the correct domain the certificate is assigned to.

Once the command runs successfully, re-open outlook and you will no longer be presented with a security warning everytime you are on the internal network.

3 responses to “Security warning when you start Outlook 2007 and then connect to a mailbox that is hosted on a server that is running Exchange Server 2007 or Exchange Server 2010: “The name on the security certificate is invalid or does not match the name of the site””

  1. Richard Fagen Avatar
    Richard Fagen

    I have a client with this EXACT problem. I tried your solution but several stations still get this popup.

    Any other ideas?

    FYI, there is a small typo on your blog

    “The name ON the security certificate is invalid or ..”
    ……….^^………
    the correct wording of the error is ON not OF.

    Reply
    1. John Avatar
      John

      Hi Richard, thanks for catching that, will update the post.

      I believe there is another step you can try, which is configuring the url for the Offline Address Book. So something similar in the Powershell console to:

      Set-OABVirtualDirectory -identity "OAB (Default Web Site)" -externalurl https://external url to cas/OAB -RequireSSL:$true

      Reply
  2. Jase Shim Avatar
    Jase Shim

    Thanks. This article helped me out. Really thank you!

    Reply

Leave a Reply

More Posts

Configuring SharePoint 2007 to accept blocked file types

One of my clients using SharePoint 2007 were uploading some files to their site recently and got the following error: The following file(s) have been blocked by the administrator By going through Central Administration, I was able to unblock the file and allow them to upload the particular file to the library they were wanting […]

Enabling BitLocker with Group Policy and backing up Existing BitLocker recovery keys to Active Directory

So getting BitLocker enabled in an Active Directory environment is fairly painless and helps to get your end user devices more Secure.  I’ll outline the steps you need to take to enable it as well as get the recovery keys stored in Active Directory.  I’ll also dive into replicating this setup on Azure AD/Intune in […]

Using WireGuard on Windows with no local administrator rights

I’ve recently been helping a non-profit uplift their security – we’ve put in a UniFi Gateway along with cleaning up their 365 tenancy and endpoint management. As part of this, we’ve implemented a WireGuard VPN back to their NAS as well as remove local admin rights from end users. Unfortunately, WireGuard by default requires local […]