[Çözüldü] EXC2016 Outlook Autodiscover Hatası

Merhaba,

Öncelikle bu işin doğrusu tek bir sertifika almanız ve ubject Alternative Name (SAN) kısmına ihtiyaç duyduğunuz ikinci veya üçüncü domainleri yazmak olacaktır. Doğru çözüm budur. Ancak siz bir hosting şirketi iseniz örnek 100 domain var ise bu bayağı bir maliyetli ve yönetmesi zor bir iş olabilir.

Diğer bir yöntem ise SRV kaydını kullanabilirsiniz, yani aşağıdaki makaledeki gibi A kayıtlarını siler, gerekli olan SRV kayıtlarını açarsanız ikinci domain için sertifika hatası almazsınız.

https://markgossa.com/2015/11/exchange-2013-2016-autodiscover-with-multiple-domains-and-single-name-certificate.html

Link eski muhtemel bir iki yıla kapanır ondan içeriği buraya alıyorum.

When setting up multiple email domains, you require a namespace for the Exchange CAS services such as OAB, EWS, Outlook Anywhere and you also need an autodiscover.domain.com A record for each domain that you require autodiscover for. In this post, I’ll demonstrate how you can configure Autodiscover for multiple domains while using only a single name on your certificate.

Background on the SRV autodiscover method

 

Outlook can use different methods to find the autodiscover response – see here. One of these methods uses an SRV record such as _autodiscover._tcp.domain.com to provide the hostname of your Exchange server such as mail.litwareinc.com. The Outlook client then retrieves the autodiscover XML file using the URL  https://mail.litwareinc.com/autodiscover/autodiscover.xml . As you can see, there is no HTTPS connection made to  https://autodiscover.domain.com  and therefore there is no need for this name on the certificate.

 

Lab setup

In this demonstration, we have an Exchange 2013 and 2016 server in the organization. The accepted domains are below:

• litwareinc.com
• litwareinc-marketing.com
• litwareinc-sales.com

Our certificate only has a single name – mail.litwareinc.com and all virtual directories, our Service Connection Points (AutodiscoverServiceInternalUri) and Outlook Anywhere hostnames/URLs are all configured to use mail.litwareinc.com.

Create the SRV records

For more information on how to create SRV records, see here. For our domains, we need to create the same SRV record in each of the forward lookup zones on our internal and external DNS servers. The SRV record we need is below:

Service: _autodiscover

Protocol: _tcp

Port Number: 443

Host: mail.litwareinc.com

Priority: 0

Weight: 0

Confirm that the SRV records are set up correctly using nslookup

Run the below commands to check that the SRV record is created correctly:

nslookup

set q=srv

server 10.2.0.10 (this needs to be one of your internal DNS servers)

_autodiscover._tcp.litwareinc.com

_autodiscover._tcp.litwareinc-marketing.com

_autodiscover._tcp.litwareinc-sales.com

Repeat the above test but set the server to a public DNS server such as 8.8.8.8 so that you can check your public SRV records are created successfully.

Remove the autodiscover.domain.com A records

Outlook clients will attempt to connect to  https://autodiscover.domain.com/autodiscover/autodiscover.xml  before they attempt the SRV method. This will cause certificate errors as this name is not on the certificate. To prevent this, you need to remove the A records below:

• autodiscover.litwareinc.com
• autodiscover.litwareinc-marketing.com
• autodiscover.litwareinc-sales.com

Test autodiscover

To test autodiscover, we’ll use a mailbox that only has an email address in the litwareinc-marketing.com domain. If the computer is joined to the domain then it will use the SCP which is mail.litwareinc.com and this should work. In this case, we want to test the SRV method so our computer needs to either be in a workgroup or outside the corporate network. In this case, it is inside the corporate network but is in a workgroup.

Below I’ll demonstrate that autodiscover works by creating a new Outlook profile:

We receive a notification that we will be redirected to  https://mail.litwareinc.com/autodiscover/autodiscover.xml  to configure server settings. To prevent being prompted for this, select the “Don’t ask me about this website again” checkbox:

As you can see above, our Outlook profile has now been autoconfigured successfully.

Note that using this method means that your users will need to use  https://mail.litwareinc.com/owa  for Outlook Web Access and that mobile devices need to be configured using mail.litwareinc.com.

Fakat buradaki sorun ise mobil istemcilerin native uygulamaları SRV desteklemiyor, daha doğrusu destekliyoruz diyorlar ama çok düzgün çalışmıyor.

Son önerim HTTP redirect.

Ne yapmalısınız.

autodiscover kaydınız olacak.Bu A kaydı exchange server değil bir IIS veya Apache vb bir sunucuyu göstermeli. Karşı tarafta bir URL yönlendirmesi tanımlamanız yeterli. Yani özetle 80 nolu portu dinleyen bir web sitesi hangi OS ve teknoloji olur ise olsun ve buraya gelen istek için siz 302 rediction yapmanız gerekli.

Bu web sitesi içerisinde Autodiscover isminde bir virtual directory altına ise autodiscover.xml isminde boş bir dosya açın.

A kaydı örnek autodiscover.hakanuzuner.com için açtınız, ancak sertifika autodiscover.cozumpark.com için tanımlı.

HTTP olarak autodiscover.hakanuzuner.com gelen istek kurduğunuz IIS vb platforma gelecek ve oradan istek https://autodiscover.cozumpark.com/autodiscover/autodiscover.xml adresine SSL li yönlendirilecek.

IIS için örnek uygulama aşağıdaki gibi olacaktır

Ancak burada da aşağıdaki gibi bir uyarı çıkacak ama bu sertifika uyarısı değil, buradaki kutucuğu işaretlediğin zaman bir daha çıkmaz. Bu bir yönlendirme uyarısı.

Bu da çıkmasın dersen aşağıdaki gibi bir durum var

After setting up the SRV record for Autodiscover service, launching Outlook 2010 or Outlook 2013, users may get the following warning.

Allow this website to configure user@domain server settings?

http://<autodiscover url>

Your account was redirected to this website for settings.
You should only allow settings from sources you know and trust.

To solve this problem, an administrator needs to add a registry setting for users.
I will use Group Policy Preferences to deploy the registry setting for users.
1. At DC01, log in as Domain Administrator.2. Launch “Group Policy Management Console“.3. Right-click the GPO which is assigned to the users using Outlook 2010,  select “Edit“.

4. Expand “User Configuration > Preferences > Windows Settings > Registry“.5. Right-click “Registry“, select “New > Registry Item“.6. Next to “Action“, select “Update“.7. Next to “Hive“, select “HKEY_CURRENT_USER“.8. Next to “Key Path“, type “Software\Microsoft\Office\14.0\Outlook\Autodiscover\RedirectServers“.9. Next to “Value name“, type “<HTTPS server to which Autodiscover can be redirected>“.
   Remark: The Key path is 14.0for Outlook 2010 and 15.0for Outlook 2013.

Example:imail.contoso.com
10. Next to “Value type“, select “Reg_SZ“.

11. Click “OK“.12. Close “Group Policy Management Editor” and “Group Policy Management Console“.
    After assigned the GPO, launching Outlook 2010, users don’t get the warning.
    Remark: If your environment is more than 1 Autodiscover record, you have to add each one.
    Reference:How to suppress the AutoDiscover redirect warning in Outlook 2010 and Outlook 2013 http://support.microsoft.com/kb/2480582
    You cannot suppress the Autodiscover redirect warning in Outlook 2007 http://support.microsoft.com/kb/956528

Özetle ver parasını al bir sertifika geç 🙂

teşekkürler hakan hocam

Rica ederiz.