We have an Exchange 2010 environment with about 150 Outlook 2010 clients. A few clients (maybe 5 in the past week) have reported getting security errors when launching Outlook that reports that "The name on the security certificate is invalid or does not match the name of the site." What weird is that the hostname it's trying to connect to isn't related to our internal Exchange 2010 environment (although it's a legit hostname that we use for SMTP delivery externally). The only catch to this last statement is that prior to our Exchange 2010 migration from 2003, we used this host as our OWA hostname.
Details:
We have two domains that we use for Exchange in addition to our AD domain (domain.local), they are reallylongdomain.com and short.com. All of our user's primary emails are user@reallylongdomain.com. We have autodiscover configured on reallylongdomain.com @ autodiscover.reallylongdomain.com.
OWA, ActiveSync, etc uses mail.short.com. mail.short.com has a valid 3rd party cert with SAN for autodiscover.short.com and autodiscover.reallylongdomain.com
Client Access is through a load balanced (Kemp load balancers) array of 2 CAS servers. Hostname for the CAS array is outlook.short.com.
The security errors are referencing mail.reallylongdomain.com. mail.reallylongdomain.com is our primary SMTP host (externally) and when that IP is accessed over HTTPS, you actually get redirected to our VPN home page, which has a valid 3rd party cert for vpn.reallylongdomain.com. So the mismatched name error makes sense, but I don't understand where the Outlook clients are getting mail.reallylongdomain.com from unless it's some holdover from the migration when we used mail.reallylongdomain.com as our OWA hostname.
Besides this specific issue, everything functions fine. Any troubleshooting advice to track down where this may be coming from would be appreciated.
Thanks.