Outlook "name on the security certificate is invalid": fix

Outlook shows this warning when the server it connected to presents a certificate whose names (SAN) do not include the hostname Outlook used. Usually Outlook did not reach your mail server at all: Autodiscover sent it to your website's host, or your account settings use an alias the mail server's certificate does not cover.

Quick fix

A mismatch between the certificate name and the server names in your account settings is the usual cause.

1. In the Security Alert dialog, click View Certificate and note the "Issued to" name and the issuer.
2. Compare that name with the server names in File → Account Settings → Server Settings (IMAP/POP and SMTP).
3. If the certificate names your hosting provider's server (for example server12.hosting.example), change the incoming and outgoing server to that exact name.
4. If the certificate belongs to your website host and the prompt mentions autodiscover, fix Autodiscover DNS (below).

Test the mail ports directly:

openssl s_client -connect mail.example.com:993 -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject

Causes

1. Autodiscover reaches the website instead of the mail service

Outlook looks up Autodiscover at https://example.com/autodiscover/autodiscover.xml and https://autodiscover.example.com/... among other locations. If the root domain's web server answers with a certificate for another name, Outlook warns.

• Confirm: the warning mentions autodiscover or example.com, and the certificate shown is your web host's.
• Fix: create autodiscover.example.com as the CNAME your mail provider documents, or publish an _autodiscover._tcp SRV record as the provider instructs. Make sure the website at example.com has a valid certificate for that name.

2. Server settings use an alias

mail.example.com is a CNAME to the provider, but the provider's certificate lists only its own hostname.

• Confirm: openssl s_client above shows a subject and SAN without mail.example.com.
• Fix: use the provider's hostname in Outlook, or ask the provider for a certificate that includes your alias.

3. Self-signed or private certificate on the mail server

• Confirm: "Issued to" and "Issued by" are the same, or the issuer is an internal CA.
• Fix: install a publicly trusted certificate for the mail hostname (see SMTP STARTTLS certificate errors). For internal Exchange, use public names.

4. Expired certificate

• Confirm: the dialog says the certificate has expired, or the date range in View Certificate is past.
• Fix: renew on the mail server and restart or reload the IMAP, SMTP and Exchange services.

5. Antivirus mail scanning

Some security products intercept IMAP/SMTP TLS and present their own certificate.

• Confirm: the issuer names the security product.
• Fix: update the product so its root is installed correctly, or disable its email scanning feature.

Fixes by environment

Every fix makes the hostname Outlook uses appear on the certificate the server presents. Test each mail port with the STARTTLS checker; the same mismatch in other mail clients is covered in SMTP STARTTLS certificate errors.

Exchange Server (on-premises): set InternalUrl, ExternalUrl and AutoDiscoverServiceInternalUri to names on the certificate, then assign the certificate to IIS, IMAP, POP and SMTP services in the Exchange admin center.

Microsoft 365 with an external website host: keep autodiscover.example.com pointed at Microsoft as documented for your tenant; the website's own certificate only needs to be valid for its names.

cPanel and similar shared hosting: many hosts publish the exact server hostname to use for "secure" mail settings; prefer it over mail.example.com unless the host issues certificates for that alias.

Outlook for Mac and mobile clients: they check certificates the same way; the fixes are identical.

Don't do this

• Install the presented certificate as "trusted" on every PC to silence the prompt. You will also trust an attacker's certificate if one appears later.
• Switch to unencrypted ports 143/110/25. Your mail password is then sent in clear text.
• Tell users to always click Yes. It trains them to accept real interception.