Can Outlook certificate errors be surpressed?

Question

We host a multi-tenant shared exchange environment and some customers are seeing a certificate warning when they open outlook as their domain name is not included in our SSL certificate as a subject alternative name. We have a wildcard certificate for this mail server.

Is it possible to surpress this error or to to basically just say 'yes' permanently?

All of the users affected access outlook on a terminal server, so I'm hoping I can throw something in the registry or whatever to get rid of this or just surpress it.

Failing that, If there is a way to make outlook stop looking for autodiscover.companyname.co.uk and instead look for anything.serverdomain.com, that would also work.

Any help appriciated.

Solution 1

This worked for me.

Certificate Error Handling

Key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\AutoDiscover
Value: ShowCertErrors
Default: 0
Data: 1 = Show certificate warnings/errors; 0 = Don't show certificate warnings

Solution 2

It can be done - Office365 doesn't have an SSL certificate for every client.

You need to look at using SRV and/or HTTP records for Autodiscover.

The most common reason for this error is the domain having a wildcard in it - so Autodiscover.example.com resolves somewhere. For the alternative methods of Autodiscover - such as SRV or HTTP then you need to ensure that Autodiscover does not resolve.

If there is something on https://example.com/Autodiscover/Autodiscover.xml then the client needs to tell their web host to turn off Autodiscover support for their domain in the control panel. It can be done - it is just something that the host has to do.

The behaviour of Autodiscover cannot be changed - it is hard coded on purpose so that the client tries a predictable set of URLs. You can go down the path of local XML files but that is not recommended as it is difficult to deploy and manage and are often forgotten about and therefore make troubleshooting very difficult.

Comments

[Marco]

+1 I always experienced and never fixed such issue. The only solution I know about is to purchase an expensive multidomain wildcard certificate.