If you use Autodiscover service by Outlook, you can see the following error (Exchange 2013 + Outlook 2013 in my case) :
Outlook error: Microsoft Outlook: The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action. Outlook error: Outlook is unable to connect to the proxy server. (Error Code 10)
The error could be due to:
- Firewall issue
- DNS failure
- Exchange misconfiguration
- Client issue
- Certificate validation failed
Well quite common problem.
- DNS resolving worked properly without any packet loss. Basically A records (mail.contoso.com, autodiscover.contoso.com) were pointed to NLB/CAS Array (Tony Redmond’s Exchange Unwashed – Exchange 2013 dumps CAS arrays).
- Autodiscover URLs were tested via IE at CAS servers (https://autodiscover.contoso.com/autodiscover/autodiscover.xml, https://localhost/autodiscover/autodiscover.xml) with results:
<?xml version="1.0" encoding="UTF-8"?> -<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006"> -<Response> -<Error Id="3876576560" Time="21:12:30.2927520"> <ErrorCode>600</ErrorCode> <Message>Invalid Request</Message> <DebugData/> </Error> </Response> </Autodiscover>
Error code 600 means autodiscover service is accessible and works. Autodiscover request is corrupted at this point but it is typical behavior for testing via IE. Very useful articles regarding to Autodiscover are White Paper: Exchange 2007 Autodiscover Service and Troublshooting Autodiscover (Exchange 2007/2010).
- Exchange virtual directories such as Set-AutodiscoverVirtualDirectory, Set-WebServicesVirtualDirectory, Set-OABVirtualDirectory, Set-ClientAccessServer –AutoDiscoverServiceInternalUri, Set-OutlookAnywhere + Set-EcpVirtualDirectory, Set-OwaVirtualDirectory, Set-ActiveSyncVirtualDirectory were configured properly.
- The client was Outlook 2013 RTM (Technet – Exchange 2013 System Requirements – Supported Clients).
- Outlook service tested via Test-OutlookWebServices indicated a cert issue:
Test-OutlookWebServices | fl Source : s04.contoso.com ServiceEndpoint : autodiscover.contoso.com Scenario : AutoDiscoverOutlookProvider ScenarioDescription : Autodiscover: Outlook Provider Result : Failure Latency : 22 Error : System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. …
The validation procedure (shortly):
- The name used to access the resource needs match the certificate exactly.
- The Certificate date must be valid
- The Certificate Authority which issued the certificate must be trusted by the client. (It needs to exist in the Trusted Root Certificate Authorities)
I checked CAS certificate issued by internal CA and I found missing letter in one SAN name. New certificate assigned to IIS service solved the error.
- How to install certificate authority on windows server 2012
- Missing Web-Server template in certsrv web interface could be solved by Certreq.exe –submit –attrib “CertificateTemplate:webserver” C:\RequestFile.req NewCertName.cer
- Configuring Certificates in Exchange Server 2013 Preview
- Connection issues and error messages in Outlook for a mailbox on a server that is running Exchange Server 2010
- Autodiscover Service Returns Unexpected Values for Outlook Anywhere Proxy Settings