KB 940726 - Exchange 2007 - "The name of the security certificate is invalid or does not match the name of the site" for intranet users

Certifications

RSS

Last Google search to here

administrative template Outlook conferencing
OCS set P-Asserted-Identity
powershell tests prometric
forefront client security hotfixes
visual redistributable

Wednesday, August 22. 2007

KB 940726 - Exchange 2007 - "The name of the security certificate is invalid or does not match the name of the site" for intranet users

This KB has some good guidance on troubleshooting and/or fixing certificate errors for intranet users that are receiving certificate warnings but external users (Outlook Anywhere) do not.

I recommend reading over the article completely but the 'quick fix' for this issue is to do the following:

1. Start the Exchange Management Shell.

2. Modify the Autodiscover URL in the Service Connection Point. The Service Connection Point is stored in the Active Directory directory service. To modify this URL, type the following command, and then press ENTER:
Set-ClientAccessServer -Identity CAS_Server_Name -AutodiscoverServiceInternalUri https://mail.contoso.com/autodiscover/autodiscover.xml

3. Modify the InternalUrl attribute of the EWS. To do this, type the following command, and then press ENTER:
Set-WebServicesVirtualDirectory -Identity "CAS_Server_Name\EWS (Default Web Site)" -InternalUrl https://mail.contoso.com/ews/exchange.asmx

4. Modify the InternalUrl attribute for Web-based Offline Address Book distribution. To do this, type the following command, and then press ENTER:
Set-OABVirtualDirectory -Identity "CAS_Server_name\oab (Default Web Site)" -InternalUrl https://mail.contoso.com/oab

5. Modify the InternalUrl attribute of the UM Web service. To do this, type the following command, and then press ENTER:
Set-UMVirtualDirectory -Identity "CAS_Server_Name\unifiedmessaging (Default Web Site)" -InternalUrl https://mail.contoso.com/unifiedmessaging/service.asmx

These steps assume that a host record exists in the DNS to map the FQDN that you specify to the IP address of the CAS server.

As always, you will want to replace every instance of mail.contoso.com with your actual domain information.

in Exchange, Microsoft, OCS / LCS, Unified Comm, Win Mobile at 14:21 | Comment (1)

6978 hits

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

Glad they finally have a KB about this. I had to deal with this at a client a couple weeks ago and was able to resolve it and created an article at the following url:
http://www.shudnow.net/2007/08/10/outlook-2007-certificate-error/

See the thing is, that even if you assign a certificate, you still want to enable it for services. You need to make sure that you assign a certificate to UM before you even assign the internalurl properly so it'll use that certificate.

As long as you assign the service to use your new certificate, you can then create your dns, and then modify the internalurl to match the CN of your certificate.

#1 Elan Shudnow (Homepage) on 2007-08-22 17:42 (Reply)

Add Comment