SSL Cert error after migrating to hosted exchange service

emailexchangemicrosoft-office-365ssl

OLD SETUP
SBS 2011 w/ Exchange and all clients running Office 2010 (using rpc/http as many were laptops)

NEW SETUP
All mailboxes and accounts moved to hosted Exchange. Local Exchange services stopped. New profiles created with new hosted Exchange settings.

PROBLEM
The local SSL cert expired last week and the clients for some reason are getting SSL cert expiration warnings when launching Outlook. I've checked the server settings and also Outlook connections (right click Outlook icon in system tray and choose Connections) and I see no references to the local Exchange server.

I've checked DNS – no zone for the domain. They used to use mail.company.com as the old reference (SSL cert for this DNS name) which was nat'd to the exchange server. They've since changed the A record for mail.company.com to a CNAME record which points to the hosted exchange service.

I can't figure out why Outlook is still looking at the internal server.

Thanks for any help in advance.

Best Answer

I'd guess that your clients are retrieving the internal autodiscover connection point from your old exchange server using the AD SCP and connecting to on-premises IIS exchange autodiscover virtual directory.

What does Get-ClientAccessServer | fl AutoDiscoverServiceInternalUri get you? You'll probably want to Set-ClientAccessServer -AutoDiscoverServiceInternalUri $nul

See also MSDN How to: Find Autodisover endpoints by using SCP lookup in Exchange: http://msdn.microsoft.com/en-us/library/office/dn467395%28v=exchg.150%29.aspx

Related Solutions

Ssl – Exchange 2007 New SSL Certificate Breaks Iphone access

I found the problem, MSExchangeSyncAppPool was not started.

Eliminate certificate warning when users access Outlook/Exchange 2010 on split domain setup

You can take care of this problem by setting the InternalURL attributes for the various Exchange components to match your external name (mail.company.com). Once you've done that you can create a DNS record (probably a CNAME for "mail.company.com" to "exchange0.company.com"-- it sounds like you named your AD domain the same as your real Internet domain name) so that clients can connect to "mail.company.com" and get directed to the Exchange Server computer.

The "set" commands for each component you'll need to run are below. You can use the "Get-" versions of these commands to see how they're set now.

Set-ActiveSyncVirtualDirectory -InternalURL
Set-AutodiscoverVirtualDirectory -InternalURL
Set-ClientAccessServer -AutodiscoverServiceInternalUri
Set-ECPVirtualDirectory -InternalURL
Set-OABVirtualDirectory -InternalURL
Set-OWAVirtualDirectory -InternalURL
Set-WebservicesVirtualDirectory -InternalURL

Best Answer

Related Solutions

Ssl – Exchange 2007 New SSL Certificate Breaks Iphone access

Eliminate certificate warning when users access Outlook/Exchange 2010 on split domain setup

Related Topic