Let me clarify a little. This isn't an unknown certificate error it's an unknown certificate error in so much as I can't figure out where the certificate comes from. This happens on a Win 7 Enterprise machine connecting to Exchange 2010 with Outlook 2010.

The error he gets is that the root is not trusted because it's a self-signed cert.

Take a look at this screenshot because even if I had generated this myself I wouldn't have put "SomeOrganizationalUnit" or "SomeCity" or "SomeState", etc. (Red block covers our domain name.) enter image description here

I'm a little concerned this is a symptom of a security breach.

Exchange 2010 has three certificates installed but none of them are this certificate. They all have different expiration dates (one is expired) and different meta-data.

edit: There are two scenarios that I see the certificate warning and one of them I can reliably repeat.

  1. When the user leaves his computer on over night Outlook pops the Security Warning window. I don't know what time this happens.
  2. Using Outlook Anywhere if I connect to Exchange externally via a cellular USB modem the Security Warning window will appear every time I close and reopen Outlook. Whether I say Yes or No does not make a difference on whether or not I can connect to Exchange and send/receive email. In other words, I can always connect to Exchange. I've checked my two Exchange servers and my Cisco router for a certificate that matches this one and I can't find it.

edit 2: Here is a screenshot of the Security Alert window. (I've been calling it Security Warning... My mistake.)

enter image description here

edit 3:

I stopped seeing this error several weeks ago but I can't tie it to any single event (because I just sort of realized that warning had stopped showing up) but I think I found the source of the certificate. Last week I found out that the certificate on our website DomainA.com was invalid. I knew that our web admin had installed a valid certificate so when I look into the problem I found out I was being presented with the invalid certificate that this posting is in regards to.

The Exchange server's domain is mail.DomainA.com so I can only guess that Outlook was passing this invalid certificate through as it did some kind of check on DomainA.com.

This issue is still a mystery because the certificate warning stopped appearing several weeks ago whereas the invalid certificate issue on the website was only fixed last week. It ended up being a problem with the website control panel. The valid certificate was installed but not being served for some reason and instead the self-signed cert was being served.

  • What does the user do when the certificate error pops up? – Tex Hex Aug 9 '11 at 17:49
  • The user clicks No. He said that this only appears when he leaves his computer on over night. And even though he clicks No he is still able to send and receive email. – Chris76786777 Aug 10 '11 at 17:39
  • Sorry, but to understand what to do about this error, we would really need to know when it is exactly appearing (for example, it happens on the reconnect to Exchange, when a message is display and so on). Sorry if my first comment was misleading what i wanted to know. – Tex Hex Aug 10 '11 at 18:17
  • I see what you're saying. There are two scenarios where I'm seeing it and I can reliably repeat one of them. I'm going to put them in my main post. – Chris76786777 Aug 10 '11 at 18:27
  • Okay, thanks for the update. Two more questions: Could you please post a screenshot of the security error message? And, the cert is valid from June 16 on onwards. Does this date ring any bell? New server, updates installed something like this? – Tex Hex Aug 10 '11 at 19:51

My best bet is currently that this certificate comes from the server that is configured to provide the Outlook Anywhere (aka ActiveSync) service or a HTTPS intercepting proxy.

This for the following reason: The error message pops up each time Outlook is trying the alternative way of accessing Exchange. When the computer is left on over the night, I guess that power management will shut down the entire computer or turn of this NIC. When this happens, Outlook will lose the primary connection and try to use the alternate (Outlook Anywhere) connection. When the user returns, power is restored but Outlook is still in the state of Main connection down and try to use Outlook Anywhere.

When using the internet connection, there is only the way of accessing Exchange through Outlook Anywhere.

Here’s a full description for the server and client settings for Outlook Anywhere, so you can check if and what is configured on your side.

If all certificates are okay for this server, you should check if your access gateway is configured to sniff into HTTPS traffic (e.g. Palo Alto Networks can do this) and the computer of this user is incorrectly configured to use this gateway when accessing Outlook Anywhere.

These boxes exchange the certificate for a HTTPS connection with their own certificate in order to be able to sniff into the traffic and scan it for problems.

  • Thanks for your dedication to this. That looks like a great guide. I'll try to get through it today. – Chris76786777 Aug 12 '11 at 17:39
  • I can't explain it. :( All signs point to this certificate not being in existence. I don't have an access gateway that would be hijacking the SSL session and all Exchange services are using real certificates. As well Outlook Anywhere (on both of my Exchange servers) is setup to use the correct FQDN for the server. I'm kind of at a loss at this point. – Chris76786777 Aug 15 '11 at 18:17
  • To be honest, I'm also run out of ideas. I would suggest that you open a case with Microsoft so they look into this. – Tex Hex Aug 15 '11 at 19:11
  • I have an update that I put in my original message. – Chris76786777 Oct 3 '11 at 17:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.