# Outlook "name on the security certificate is invalid": fix

> Outlook warns that the certificate name is invalid when Autodiscover, IMAP or SMTP reaches a server whose certificate lacks that hostname. How to fix it.

Source: https://ssl.sh/errors/outlook-certificate-warning/
Last updated: 2026-11-10

**Outlook shows this warning when the server it connected to presents a certificate whose names ([SAN](https://ssl.sh/glossary/san/)) do not include the hostname Outlook used.** Usually Outlook did not reach your mail server at all: Autodiscover sent it to your website's host, or your account settings use an alias the mail server's certificate does not cover.

## Quick fix

A mismatch between the certificate name and the server names in your account settings is the usual cause.

1. In the Security Alert dialog, click **View Certificate** and note the "Issued to" name and the issuer.
2. Compare that name with the server names in **File → Account Settings → Server Settings** (IMAP/POP and SMTP).
3. If the certificate names your hosting provider's server (for example `server12.hosting.example`), change the incoming and outgoing server to that exact name.
4. If the certificate belongs to your website host and the prompt mentions `autodiscover`, fix Autodiscover DNS (below).

Test the mail ports directly:

```bash
openssl s_client -connect mail.example.com:993 -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject
```

## Causes

### 1. Autodiscover reaches the website instead of the mail service

Outlook looks up Autodiscover at `https://example.com/autodiscover/autodiscover.xml` and `https://autodiscover.example.com/...` among other locations. If the root domain's web server answers with a certificate for another name, Outlook warns.

- **Confirm:** the warning mentions `autodiscover` or `example.com`, and the certificate shown is your web host's.
- **Fix:** create `autodiscover.example.com` as the CNAME your mail provider documents, or publish an `_autodiscover._tcp` SRV record as the provider instructs. Make sure the website at `example.com` has a valid certificate for that name.

### 2. Server settings use an alias

`mail.example.com` is a CNAME to the provider, but the provider's certificate lists only its own hostname.

- **Confirm:** `openssl s_client` above shows a subject and SAN without `mail.example.com`.
- **Fix:** use the provider's hostname in Outlook, or ask the provider for a certificate that includes your alias.

### 3. Self-signed or private certificate on the mail server

- **Confirm:** "Issued to" and "Issued by" are the same, or the issuer is an internal CA.
- **Fix:** install a publicly trusted certificate for the mail hostname (see [SMTP STARTTLS certificate errors](https://ssl.sh/errors/smtp-starttls-certificate-error/)). For internal Exchange, use public names.

### 4. Expired certificate

- **Confirm:** the dialog says the certificate has expired, or the date range in View Certificate is past.
- **Fix:** renew on the mail server and restart or reload the IMAP, SMTP and Exchange services.

### 5. Antivirus mail scanning

Some security products intercept IMAP/SMTP TLS and present their own certificate.

- **Confirm:** the issuer names the security product.
- **Fix:** update the product so its root is installed correctly, or disable its email scanning feature.

## Fixes by environment

Every fix makes the hostname Outlook uses appear on the certificate the server presents. Test each mail port with the [STARTTLS checker](https://ssl.sh/tools/starttls-checker/); the same mismatch in other mail clients is covered in [SMTP STARTTLS certificate errors](https://ssl.sh/errors/smtp-starttls-certificate-error/).

**Exchange Server (on-premises):** set `InternalUrl`, `ExternalUrl` and `AutoDiscoverServiceInternalUri` to names on the certificate, then assign the certificate to IIS, IMAP, POP and SMTP services in the Exchange admin center.

**Microsoft 365 with an external website host:** keep `autodiscover.example.com` pointed at Microsoft as documented for your tenant; the website's own certificate only needs to be valid for its names.

**cPanel and similar shared hosting:** many hosts publish the exact server hostname to use for "secure" mail settings; prefer it over `mail.example.com` unless the host issues certificates for that alias.

**Outlook for Mac and mobile clients:** they check certificates the same way; the fixes are identical.

## Don't do this

- **Install the presented certificate as "trusted" on every PC** to silence the prompt. You will also trust an attacker's certificate if one appears later.
- **Switch to unencrypted ports 143/110/25.** Your mail password is then sent in clear text.
- **Tell users to always click Yes.** It trains them to accept real interception.