Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com ), so withholding your domain name here does not increase secrecy, but …

I haven’t followed this entire thread, but it would be worth checking what hostname the mail client is configured to use. Depending on your DNS setup, it’s possible the mail client has a different name that happens to resolve correctly but isn’t on the certificate.

User says, "Outlook for Windows(C2R) v16.0.15726.20174 in the Office 365 suite."

I don't think it sees that, the only place I see it is in the Qualys report. Apache is using SNI to serve multiple SSL-encrypted sites from a single IP, so apparently Qualys is doing something with its requests that doesn't follow the SNI browser protocols.

SSLLabs does both: with and without SNI.

[image] Bruce5051: Still would be nice to have Certificate Path that Outlook see. Working on this...

[image] Bruce5051: But all 3 are sending the Self-signed ISRG Root X1 (RSA 4096, O = Internet Security Research Group, CN = ISRG Root X1) which they should not be doing. Here are 3 more links on Chains: [image] Verifying a certificate Help … [image] …

Am I looking at using the certbot --preferred-chain option when creating/updating certs, or the openssl -trusted-first option when exporting a PKCS12 file from the LE cert? I'm scratching my head trying to figure out where the "extra" root is coming from. Is it included in the LE cert, or is my sys…

[image] jlgtx: Is it included in the LE cert (…) it is not. [image] jlgtx: (…) or is my system adding it during the openssl export? I don't think OpenSSL, with the command you've posted earlier, would do that as you're only using the files provided by Certbot. And they don't include t…

It looks like the server is adding that anchor when it creates the certs in /etc/certificates, to which it then points the various service configs. I'm chasing that down. [JLG] macOS Server: How to remove self-signed root from website SSL cert chain? keychain, osx-server,…

[image] mcpherrinm: Depending on your DNS setup, it’s possible the mail client has a different name that happens to resolve correctly but isn’t on the certificate. It's looking for " mail.brazoslink.net " which is in the cert.

Office365 Outlook "target principal name is incorrect" error with multi-domain cert

Help

Bruce5051 November 14, 2022, 7:51pm 39

Here are 3 more links on Chains:

Topic		Replies	Views
Let's Encrypt - Outlook Office 365 "Target principal name is incorrect" Help	9	4338	March 18, 2019
Outlook - The target principal name is incorrect Help	9	2094	January 17, 2021
Multiple certificates with the same common name Help	20	6296	May 11, 2018
Outlook Pop Up for SSL Help	24	6994	May 1, 2019
Outlook stopped recognizing LetsEncrypt Cert after renew Help	31	3324	December 25, 2022

Office365 Outlook "target principal name is incorrect" error with multi-domain cert

Related topics