Outlook desktop can’t connect to Exchange; Autodiscover & cert mismatch.

Question

I’m having trouble connecting Outlook desktop to our Exchange server (<removed PII>). Here’s a quick summary:

Outlook desktop errors:

“Cannot start Microsoft Outlook. The set of folders cannot be opened. The attempt to log on to Microsoft Exchange has failed.”

Or “Security Alert: The name on the security certificate is invalid or does not match the name of the site.”

Outlook Web (OWA) works fine.

Findings:

Server: <removed PII>, Exchange 2019 CU11

Certificate CN = mail.<domain>.local, SAN includes mail.<domain>.local and autodiscover.mail.<domain>.local

Autodiscover service is currently autodiscover.<domain>.local → does not match certificate SAN

MAPI and EWS Internal URLs point to mail.<domain>.local

Impact:

Outlook desktop cannot connect internally.

Security alerts due to certificate mismatch.

Request:

Update DNS: autodiscover.mail.<domain>.local → <removed PII> IP

Configure AutodiscoverInternalUri to match certificate:

Set-ClientAccessService -Identity "<removed PII>" -AutoDiscoverServiceInternalUri "https://autodiscover.mail.<domain>.local/Autodiscover/Autodiscover.xml" iisreset

Verify MAPI, EWS, Autodiscover URLs for consistency.

Please let me know once these changes are applied so Outlook desktop clients can connect properly.

Thanks,

Answer 1

Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.

Hi @Lamiae elhaqui 

Thanks for reaching out to the Microsoft Q&A forum. 

Based on your description, I understand you're seeking confirmation that updating your Autodiscover settings to match the certificate's SAN is intended to resolve the message: "Security Alert: The name on the security certificate is invalid or does not match the name of the site." 

As a forum moderator, I don’t have access to a dedicated testing environment to replicate individual user scenarios. However, I’m here to support you based on official Microsoft documentation and valuable insights shared by other community members. 

From my research, your approach aligns well with documented best practices.
1.Updating DNS records is a crucial step to ensure Outlook can connect and function properly.

Reference: Autodiscover services in Outlook

2. Using PowerShell to configure the AutodiscoverInternalUri so it matches the certificate, followed by an IIS reset, is a valid and commonly recommended step.
Reference: Set-ClientAccessService (ExchangePowerShell) | Microsoft Learn 

3.Verifying the consistency of MAPI, EWS, and Autodiscover URLs is also a great practice to ensure everything is aligned.
You can use the following PowerShell commands to check:

Get-WebServicesVirtualDirectory  -Server <yourExchangeServer>| Format-List InternalUrl, ExternalUrl 
Get-MapiVirtualDirectory -Server <yourExchangeServer> | Format-List InternalUrl, ExternalUrl 
Get-AutodiscoverVirtualDirectory -Server <yourExchangeServer>| Format-List InternalUrl, ExternalUrl 

References: 

• Get-WebServicesVirtualDirectory (ExchangePowerShell) | Microsoft Learn 
• Get-MapiVirtualDirectory (ExchangePowerShell) | Microsoft Learn 
• Get-AutodiscoverVirtualDirectory (ExchangePowerShell) | Microsoft Learn 

You may also find the Microsoft Remote Connectivity Analyzer helpful. It simulates client connections (such as Outlook) to your Exchange server and can validate whether your setup is successful. 

For Classic Outlook clients, you might consider creating a new profile to test in a clean environment. This allows you to troubleshoot without impacting your existing data or settings. 

I hope this provides additional clarity for your situation. If you have any further concerns or questions, please feel free to reach out. 

Please note that this is the fr-fr forum. We kindly recommend posting your question in French so that more community members can assist you. Alternatively, you may consider posting in the English forum if you prefer to use your native language. We sincerely appreciate your understanding.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.   

Answer 2

Bonjour,

Sur ce forum on utilise la langue Française. Si ça vous dérange allez sur le Forum U.S. Il est ici : https://learn.microsoft.com/en-us/answers/questions/

Bonne continuation.

La modération.

Daniel