office.outlook.com and smtp.office365.com SSL Certificate Random Changes between calls

ssl outlook office365 office365api

11,210

Faced a similar issue today. I could not find a complete list of cert used by MS O365.
Closest is this Exchange Online/Office 365 SSL certificate info, but seems outdated: https://technet.microsoft.com/en-us/library/mt163898.aspx

Here a list of IP and URL: https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2
(here as RSS: https://support.office.com/en-us/o365ip/rss)

I btw, use SMTP send via JAVA and need to trust every cert. as of today I found smtp.office365.com:995 uses

CN=DigiCert Cloud Services CA-1, O=DigiCert Inc, C=US
81:B6:8D:6C:D2:F2:21:F8:F5:34:E6:77:52:3B:B2:36:BB:A1:DC:56
Valid from Aug 4, 2015 to Aug 4, 2030.

Here the output from openssl

|ts@nix:~$ echo | openssl s_client -showcerts -servername smtp.office365.com -connect smtp.office365.com:995 2>/dev/null | openssl x509 -inform pem -noout -text
|Certificate:
|    Data:
|        Version: 3 (0x2)
|        Serial Number:
|            03:04:74:d9:a7:51:7a:9d:33:f4:b4:1c:00:fd:4f:e7
|    Signature Algorithm: sha256WithRSAEncryption
|        Issuer: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1
|        Validity
|            Not Before: Dec 12 00:00:00 2016 GMT
|            Not After : Dec 12 12:00:00 2017 GMT
|        Subject: C=US, ST=WASHINGTON, L=Redmond, O=Microsoft Corporation, CN=outlook.com
|        Subject Public Key Info:
|            Public Key Algorithm: rsaEncryption
|                Public-Key: (2048 bit)
|                Modulus:
|                    00:c7:eb:fe:5c:ae:a6:90:28:b7:1c:a8:3b:4c:e6:
|                    42:2c:ca:4b:0f:b1:fb:23:79:39:1e:7d:06:91:cd:
|                    20:bd:c6:f9:94:25:2e:a8:b3:2e:bf:13:9c:68:85:
|                    2b:f2:68:e0:51:bb:63:f0:69:fa:4f:d8:44:68:4c:
|                    41:8e:6b:88:8a:63:c4:03:0f:c3:68:66:22:e6:c1:
|                    ba:82:da:ce:6c:53:6e:aa:72:0a:3d:ce:11:95:a1:
|                    0e:17:46:ef:ce:15:76:91:7e:c1:ec:e9:04:38:43:
|                    71:a4:b6:74:05:46:5c:4d:2e:6a:1d:95:ef:c3:a8:
|                    2a:b5:48:50:ca:ab:ea:0f:2e:41:6f:ac:07:6f:d0:
|                    b4:50:0b:cd:7b:2f:3c:8d:f3:fa:d1:3e:f7:df:08:
|                    08:33:ee:97:0a:5d:63:db:27:43:6a:a1:db:67:ab:
|                    71:23:41:23:58:b9:33:52:8d:86:b9:7a:13:59:d8:
|                    ba:9e:1a:e1:74:16:bb:52:d8:f9:62:e3:3a:45:c6:
|                    06:8b:c4:ec:74:54:d5:96:c7:95:26:04:0e:88:d8:
|                    51:68:42:cb:2c:de:91:c1:2e:ea:d2:da:63:c9:32:
|                    89:9f:d6:5d:94:0f:e0:0f:75:8d:0e:3b:45:d2:5c:
|                    bf:bb:88:36:38:cb:1f:da:bf:84:80:d6:7a:f5:5f:
|                    3d:ad
|                Exponent: 65537 (0x10001)
|        X509v3 extensions:
|            X509v3 Authority Key Identifier:
|                keyid:DD:51:D0:A2:31:73:A9:73:AE:8F:B4:01:7E:5D:8C:57:CB:9F:F0:F7
|
|            X509v3 Subject Key Identifier:
|                83:AF:FF:4C:89:EE:ED:0A:7E:D8:3E:2F:ED:55:F8:9C:9F:85:DF:16
|            X509v3 Subject Alternative Name:
|                DNS:ccs.login.microsoftonline.com, DNS:ccs-sdf.login.microsoftonline.com, DNS:outlook.com, DNS:*.outlook.com, DNS:office365.com, DNS:*.office365.com, DNS:*.live.com, DNS:*.internal.outlook.com, DNS:*.outlook.office365.com, DNS:outlook.office.com, DNS:attachment.outlook.office.net, DNS:attachment.outlook.officeppe.net, DNS:*.clo.footprintdns.com, DNS:*.office.com
|            X509v3 Key Usage: critical
|                Digital Signature, Key Encipherment
|            X509v3 Extended Key Usage:
|                TLS Web Server Authentication, TLS Web Client Authentication
|            X509v3 CRL Distribution Points:
|
|                Full Name:
|                  URI:http://crl3.digicert.com/DigiCertCloudServicesCA-1-g1.crl
|
|                Full Name:
|                  URI:http://crl4.digicert.com/DigiCertCloudServicesCA-1-g1.crl
|
|            X509v3 Certificate Policies:
|                Policy: 2.16.840.1.114412.1.1
|                  CPS: https://www.digicert.com/CPS
|                Policy: 2.23.140.1.2.2
|
|            Authority Information Access:
|                OCSP - URI:http://ocspx.digicert.com
|                CA Issuers - URI:http://cacerts.digicert.com/DigiCertCloudServicesCA-1.crt
|
|            X509v3 Basic Constraints: critical
|                CA:FALSE
|    Signature Algorithm: sha256WithRSAEncryption
|         7f:ac:07:6a:f0:78:0d:1f:a6:f1:c2:49:67:b4:7d:1f:e0:20:
|         ae:87:88:3f:5e:6a:5e:98:36:31:e0:57:dc:c2:8f:9e:59:ba:
|         32:38:cd:9c:3d:44:f4:62:d9:2a:4d:1c:75:38:56:03:17:b1:
|         4b:57:71:48:3f:41:a9:ff:02:e5:f9:de:c1:fd:8d:9a:c1:e5:
|         cc:ce:78:00:2a:b8:53:d7:fe:42:50:0a:83:55:03:76:9c:44:
|         70:14:38:bc:6f:0a:f0:1a:8e:98:d9:ec:b7:81:7b:6f:20:aa:
|         31:da:f6:51:f5:7c:93:3a:2b:74:cf:90:0c:b0:d1:dd:25:72:
|         f2:50:ca:2d:18:c9:c9:4e:25:71:84:a1:0e:67:34:85:a2:db:
|         c8:7e:b6:05:95:d7:a9:a2:ce:07:c3:c1:63:88:71:11:bd:1d:
|         b7:15:4a:9a:22:73:3e:f7:f0:f3:da:b1:b4:8a:45:9d:b2:45:
|         28:6e:8c:a7:9b:78:93:3f:07:33:68:77:bb:4d:80:37:d2:8e:
|         f0:51:cf:b6:41:79:21:1d:e5:03:2f:44:c0:a4:e4:a0:a3:ef:
|         82:20:b0:44:70:e7:a0:a5:a8:83:96:a9:17:05:a4:43:36:74:
|         d9:ca:84:21:97:7b:e7:27:fb:95:43:ce:e5:7a:64:e4:5e:b7:
|         ae:5f:f4:9d

11,210

Author by

bvstone

President and owner of BVSTools, Inc. An IBM i (AS/400, iSeries, System i) software and consulting company that has been around since 1995.

Updated on June 04, 2022

Comments

bvstone almost 2 years

This may sound weird, but I have customers using my software that connects the IBM i (AS/400) to the office REST API using the host:

outlook.office.com

The URI used is: https://outlook.office.com:443/api/v2.0/me/sendmail

I also have some using the office365 smtp server at: smtp.office365.com port 587

I have confirmed that each of these randomly changes which SSL certificate they are presenting. This of course causes problems if they don't have one or the other CAs installed on their systems.

Any idea why this is happening? And how is that possible? Maybe some of the servers on their server farm are out of date or not updated? Seems pretty odd for MS to have an issue like this.

Here are the two certificates from outlook.office.com, both retrieved using SSL just a few minutes ago. I got lucky and was able to get both in two separate but same requests. I have yet to capture the 2nd one from smtp.office.365.com:587 UPDATE: I finally got the 2nd one from smtp.office365.com. I hope there are only 2. I put them below.

First cert:

Second cert:

First cert:

Second Cert:

I also hate to say it, but it's sad when paying customers are asking for help, even through an ISV like me and get ZERO response. Yes, I did post this here, at the social.msdn site and an Office 365 developers site. One customer even called support and was told "sorry, we can't help you."

Real tight ship there, MS. Real tight ship. Can't wait for this to happen when they renew certificates again in a year.