Topic Last Modified: 2009-06-15

The Microsoft Exchange Server Analyzer Tool queries the Server Certificate object in the Exchange server system to retrieve various properties on X509 certificates. For each Secure Sockets Layer (SSL) certificate found, the Exchange Server Analyzer evaluates the Principal attribute to identify the fully qualified domain name (FQDN) that was assigned to the certificate, for example, www.microsoft.com.

Microsoft Exchange Server Analyzer issues a warning when the Principal FDQN name does not match the host address or URL. The certificate Principal mismatch warning means that users might not be able to connect to their mailboxes using Microsoft Office Outlook® Web Access for Exchange Server 2003, Outlook Anywhere for Exchange Server 2007, Exchange Server ActiveSync, and RPC over HTTP.

Symptoms of this issue include being repeatedly prompted for credentials when attempting to connect to Exchange Server and receiving the error, "An encrypted connection to your mail server is not available. Click Next to attempt using an unencrypted connection."

A mismatch may result if one of the following conditions is true:

• The certificate is accidentally applied to the wrong server.
  
  
• The client accesses data on a server through the wrong host URL when servers have more than one host name.
  
  

To resolve the certificate name mismatch

• Verify that the SSL certificate has been granted and applied to the correct host and, if not, replace the current certificate with a new one issued to the FQDN you entered as the Certificate Principal Name in the Exchange Proxy Settings in Outlook Anywhere. To review the FQDN entered in the Exchange Proxy Settings:

  1. On the Tools menu, click Account Settings, select the Exchange account, and then click Change.
     
     
  2. Click More Settings, and then click the Connection tab.
     
     
  3. Click Exchange Proxy Settings.
     
     
  4. Review the Only connect to proxy servers that have this principal name in their certificate check box for the correct FQDN.
     
     

• Use the Exchange Management Shell to modify the CertPrincipalName attribute as follows:

  	Copy Code
  Set-OutlookProvider EXPR -CertPrincipalName:"msstd:<FQDN the certificate is issued to>"

This error can also occur when the Exchange Server Analyzer Tool detects recipient polices that apply to internal SMTP domains that no longer exist in Exchange. In this case, the Exchange Server Analyzer Tool issues the following message:

Certificate principal mismatch

To resolve this issue, you must delete the recipient polices that apply to SMTP domains that no longer exist or are no longer used.

For More Information

© 2009 Microsoft Corporation. All rights reserved.