Renew Exchange UCC Certificate without .local domain


So you need to renew your UCC exchange cert but now you can't renew the "domain.local" cert that you've been using forever? Think you can just renew the external and be ok? Wrong, your internal users would get a prompt when they launch outlook saying that the domain names do not match and they will have to click "yes" to continue every time they open it. How do we fix this?

Well, I recently came across this issue and here's how I fixed it

First, make sure that loopback is working in the local office. Try pinging your domain, let's say it's Does it resolve to an external ip? If not, you need to adjust your firewall settings so that it routes requests to the external domain to the WAN interface. This should be done by default if you used the wizard on your sonicwall.

Now, open up exchange management console and change the OWA, OAB and ActiveSync address so that they all point to the external address. For Example change mail.domain.local/owa to

Now open exchange Powershell as admin and adjust the script below accordingly to change you're autodiscover address

Set-WebServicesVirtualDirectory -Identity “ESERVER01\EWS (Default Web Site)” -InternalUrl -BasicAuthentication:$true

Set-WebServicesVirtualDirectory -Identity “ESERVER01\EWS (Default Web Site)” -ExternalUrl -BasicAuthentication:$true

Now we need to run another command to change the autodiscover.xml address

Set-ClientAccessServer -Identity ESERVER01 –AutoDiscoverServiceInternalUri

Lastly, to make all these changes take effect, we need to recycle the App Pools

Open IIS manager

Expand the server and expand Application Pools, then right-click on MSExchangeAutodiscoverAppPool, and select Recycle

Voila! now, users should not be receiving the Cert error in outlook


If this guide helped you out, feel free to share a link or buy me a beer/coffee below :-)

**Full Disclosure**
I don't make money from this site and I don't have any intention of monetizing. Thanks to a few kind souls who recently made a few generous donations, I was motivated to migrate this site to github. I'm hoping things will continue to function as well as it did on Weebly but web development is not my expertise so I'm learning as I go. If you'd like to encourage further development or just say thanks, I've provided a donation link below. Thanks again guys!