MS Exchange Server 2016 Certificate error fix up


By MAS MVE Exchange Server, Windows Server, Active Directory, Virtu alization, Skype for Business Expert.

This article will help to fix the below errors for MS Exchange Server 2016
I. Certificate error “name on the security certificate is invalid or does not match the name of the site”
II. Out of Office not working
III. Make Internal URLs and External URLs the same
IV. Address book download issue

Most administrators don’t check the complete URLs that Exchange uses for serving MAPI clients or they miss URLs required to set and add certificate names after installing Exchange Server. 

 

Below are fixes for those errors.

Note: Replace “exchange.online” with your domain name in all the examples below.

1. First make sure you have a Forward lookup zone for your domain in your internal DNS server, e.g. exchange.online.


2. Then create the below A records in the newly created zone that point to the exchange CAS/HUB server IP or load balancer IP if you have one (as in the screenshot):
     a) autodiscover.exchange.online
     b) mail.exchange.online (common name)

 

 

3. Then make sure you have all the required names added as SANs in your SSL Certificate. The below names should be present for a single domain exchange:
     a) mail.exchange.online (common name)
     b) autodiscover.exchange.online

The following command will list your SANs/names in the certificate: 

3.1 If you have multiple domains you have to add below SANs to your SSL Certificate:
     a) mail.exchange.online (common name1)
     b) autodiscover.exchange.online
     c) autodiscover.exchange2.online
     d) autodiscover.exchange3.online

OR

3.2 You can have one common name and one autodiscover name in the certificate and redirect all the common names to commonname.exchange.online and redirect all autodiscover to autodiscover.exchange.online.com as below:
     a) mail.exchange.online (common name1) —-> A record points to Exchange server IP
     b) autodiscover.exchange.onilne ——> A record points to Exchange server IP
     c) autodiscover.domain2.com SRV record to redirect to autodiscover.domain1.com as below

         Name: @ 

         Service: _autodiscover    Do not for to add “_” at the beginning.
         Protocol: _tcp                  Do not for to add “_” at the beginning.
        Target: autodiscover.domain1.com Outlook will be redirected to this name.
         Priority: 10  
         Weight: 10
         Port: 443

Name: All you need here is the @ symbol. This will default the record to the parent domain. In our case it will append domain2.com creating a complete record of _autodiscover._tcp.domain2.com.

Service: Enter _autodiscover. Be sure to include a single underscore in front of it. By design this is one of the names the Outlook client looks for.
Protocol: Enter _tcp. Be sure to include a single underscore in front of it. By design autodiscover requests are performed over TCP connections.
Target: This is where we want our Outlook clients redirected. This has to be a name that exists on our SSL certificate. In our case autodiscover.domain1.com
Priority: If you only have one autodiscover SRV record then it really doesn’t matter what you enter here. This is for high availability. The lowest priority number will always be used first. If it is unavailable the next lowest number will be used and so on. In our case we only have one record, so we just went with 10. But we could just have easily made it 0 or 100.
Weight: Weight is used for load balancing multiple SRV records. Should you have two SRV records with the same priority, then weight is factored in. A higher value in weight means it is preferred and more connections are sent to it. In our case we only have a single SRV record so it does not matter what we enter here. We went with 10 again.
Port: All connections will be over HTTPS. This is port 443.

4. Make sure IIS is enabled and the third party certificate installed.
Type “Get-ExchangeCertificate” in Exchange Management Shell to see if IIS is enabled.

Exchange 2016 Shell
Before services enabled

Use the command shown below to enable the services. You can change the services according to your requirement. but IIS is mandatory.

Select allOpen in new window

After services enabled

Exchange 2016 EAC
You can assign and enable service certificates in Exchange 2016 from the EAC. Below are the steps with screenshots showing how to enable and assign services:

 a) Click on the imported third party certificate and click the “Edit” button

b) Click on Services

c) Select SMTP and IIS.  If you’re also using POP and IMAP, select them as well.

You can read this TechNet article for more information on how to assign services to certificates in Exchange 2016.

5. Enter the below command in Exchange Management Shell to see if the Autodicover URLs are set.

Select allOpen in new window

If you see the default URLs set by exchange installation (as above) use the below command to set it to the same as external. 

Select allOpen in new window

You should see as in the screenshot below after running the command again.

6. Enter the below command in Exchange Management Shell and see if the offline address book URLs are set. 

Select allOpen in new window

If you see the default URLs set by exchange installation (as above) use the below command to set it to the same as external.

Select allOpen in new window

You should see the as in the screenshot below after running the command again.

a) In Exchange 2016 OAB URLs can be set from the EAC. Click on “OAB (Default Web site)” and click the “Edit”  button.

b) Enter the external and internal URLs with the same value (i.e. external name) and click “Save”.

7. Enter the below command in Exchange Management Shell to see if the Exchange Web Services’ URLs are set.

Select allOpen in new window

If you see the default URLs set by the Exchange installation (as above), use the below command to set it to the same as the external.   

Select allOpen in new window

You should see the following result after after running the command again.

a) In Exchange 2016, the EWS URLs can be set from the EAC.  Click on “EWS (Default Web site)” and click the “Edit”  button.

II. Enter the external and internal URLs with the same value (i.e. external name) and click “Save”.

8. Enter the below command in Exchange Management Shell to see if the Mapi URLs are set.

Select allOpen in new window

If you see the default URLs set by the Exchange installation (as above), use the below command to set it to the same as the external.   

Select allOpen in new window

You should see the following result after running the command again:

a) In Exchange 2016, the mapi URLs can be set from the EAC.  Click on “mapi (Default Web site)” and click the “Edit”  button.

II. Enter the external and internal URLs with the same value (i.e. external name) and click “Save”.

9. On a client workstation; Check to see that the Out of Office URL is correct in a client’s Outlook.

Press Ctrl and right-click on the Outlook icon located in your system tray, then select “Test E-mail AutoConfiguration”.

Enter the email address and password for the mailbox you have opened. Since we are not using POP3 or IMAP, there is no reason to leave the Guessmart checkboxes checked.



After clicking Test, look for the the URL used to configure OOF (as indicated below)

Please reset IIS using the command below (Optional but recommended).

Now you should have all your errors cleared.

 

 

 

 

 

 

 

 

 

 

8 Comments on “MS Exchange Server 2016 Certificate error fix up

  1. Good post. I learn something new and challenging on sites I stumbleupon everyday.

    It’s always exciting to read articles from other authors and practice a little something
    from their web sites.

  2. www.axiamedica.it on

    I got this sіte from my pal who informed me regarding this
    website and now this time I am browsing this site and rеading very informative posts at this time.

  3. I have read so many posts օn the topic of the blogger. However this post is actᥙally a fastidiouuѕ
    piece of ᴡriting, keep it up.

  4. Іt’s really a cool and useеful pieϲe oof information. I am satisfied that
    y᧐u simρly shared thіs helρful info with us.
    Please stay uus informed liкe thiѕ. Tank you fߋr sharing.

  5. Thank you, I value it.

  6. Thanks for finally talking about >MS Exchange Server 2016 Certificate error fix up | Practicalworld

  7. We are a group of volunteers and opening a new scheme in our community.

    Your site offered us with helpful information to work on. You’ve performed a formidable process and our entire community will be thankful to you.

  8. I used to be able to find good advice from your articles.

Leave a Reply

Your email address will not be published. Required fields are marked *

*
*