Outlook security alert

[Jobos]

Right so I've got Exchange 2010 with Outlook 2010 clients and everything was working fine, no problems at all for the last 4 years. Now all of a sudden staff are getting a security alert saying the cert has a problem. The only changes I'm aware of is the webfilter has changed and up until autumn last year the school was using the Openhive web filter and one could install their cert on domain machines to enable https inspection.

 

Now the school has moved to Capital Bytes filter the openhive cert is not required so I removed it via gp.

 

What's interesting here is why staff are getting the error. Looking at the attached, the view certificate box it still lists openhive when we have nothing to do with them anymore. The cert valid from / to dates are correct so I'm guessing we are somehow connecting to openhive and that is why we are receiving the error.

 

In IE the proxy is correctly set to Capital Bytes and all domain machines have been changed using netsh so I don't know why the old proxy is still in play.

 

[jamesb]

It looks as though your Exchange cert was provided by Openhive, and is signed by their certificate. If you've removed the certificates from the workstations they'll no longer be trusted.

 

You'll want to replace the Exchange cert with something signed by a trusted CA.

[Jobos]

That is just my point, the Exchange cert is by Trustico and not Openhive.

[pantscat]

Outlook is probably caching the old certificate... not sure why though!

 

Try this:

 

Close Outlook.

Open the Control Panel and then Internet Options.

Go to the Content tab.

Click the Clear SSL State button.

Reboot and then restart Outlook.

 

Curious...

[Jobos]

Still the same but now I'm wondering if there might be something in the mandatory profile that is causing issues. Can't think what though!

[jamesb]

If you've got OWA available, what certificate do you see when you reach it?

[Jobos]

Well that works fine and is the only way staff can access their email. The cert is unaltered as it should be.

[pantscat]

Try an AD account without a profile attached?

[Jobos]

Try an AD account without a profile attached?

 

I'm back there tomorrow so will try then.

[Jobos]

Right so it is the profile that is causing the cert error but there's no sign of any openhive cert in IE. Very odd. But if that wasn't enough a quick and dirty fix is to open IE first before opening Outlook then there isn't any cert error and Outlooks opens fine.

[pantscat]

Thought it might be - time for a shiny new profile!

[sukh]

All users effected via outlook?

[Jobos]

No, not all users just the ones who use the mandatory profile. I have remade the profile and the problem went away.