Outlook Certificate Error: The Name on the Security Certificate Is Invalid

You may see a certificate error in Outlook stating the name on the security certificate is invalid or does not match the site. This error typically appears when connecting to an Exchange server or other mail service. It indicates a mismatch between the server’s identity and the certificate it presents. This article explains why this happens and provides steps to resolve the connection issue.

Why Outlook Shows an Invalid Certificate Name

This security warning occurs because Outlook uses the Secure Sockets Layer protocol to encrypt your connection to the mail server. The server must prove its identity with a digital certificate issued by a trusted authority.

The error triggers when the name on the certificate, like mail.company.com, does not match the server address you are connecting to, such as owa.company.local. This is a common configuration issue in corporate environments where internal server names differ from public domain names.

Outlook and Windows validate the certificate to prevent man-in-the-middle attacks. If the validation fails, Outlook blocks the connection to protect your data. You must address the root cause rather than simply ignoring the warning.

Common Scenarios for the Mismatch

A frequent cause is using an internal server name for your Exchange server while the certificate is issued for a different external name. For example, your Outlook profile may connect to EXCH01 but the certificate is for mail.contoso.com.

Another scenario involves certificates from an internal Certificate Authority that is not trusted by your Windows device. Your IT department may have issued the certificate, but your computer lacks the necessary root CA certificate in its trust store.

Steps to Resolve the Invalid Certificate Error

Follow these steps in order. Start by checking simple system settings before modifying certificates.

1. Verify Windows Date and Time
   Right-click the clock in your taskbar and select Adjust date and time. Ensure the Set time automatically and Set time zone automatically options are turned on. An incorrect date can make valid certificates appear expired.
2. Check the Server Name in Your Account Settings
   In Outlook, go to File > Account Settings > Account Settings. Select your email account and click Change. Note the server names listed. Click More Settings, then go to the Security tab. Check if a specific certificate name is defined under Secure server certificate name. Often, this field should be left blank to use the server’s default certificate.
3. Add the Root Certificate to Windows Trust Store
   You may need to install a root certificate from your organization. Open the Start menu, type Internet Options, and select it. Go to the Content tab and click Certificates. Click the Trusted Root Certification Authorities tab. Click Import to add the certificate file provided by your IT administrator. This tells Windows to trust certificates issued by your company’s CA.
4. Update the Outlook Profile with the Correct Server Name
   If the certificate name is fixed, your connection profile may need updating. In Account Settings, change the server fields to match the name on the certificate. For example, change the server from an internal name like EXCH01 to the external name mail.yourcompany.com. You may need to contact your IT support for the correct server address.
5. Use the Microsoft Support and Recovery Assistant
   Download and run the Microsoft Support and Recovery Assistant from the official Microsoft website. Select Outlook and run the diagnostic for connection problems. The tool can often detect certificate mismatches and suggest automatic fixes.

If the Certificate Error Persists

Outlook Still Shows the Error After Adding the Certificate

Close and reopen Outlook after importing the root certificate. If the error remains, the specific server certificate itself may need to be installed on your machine. Request the .cer file for the exact mail server from your IT department. Import this into the Intermediate Certification Authorities store in the Internet Options Certificates dialog.

You Cannot Contact Your IT Administrator

As a temporary workaround for a corporate device you trust, you can add the certificate site to the Trusted Sites zone. In Internet Options, go to the Security tab, select Trusted Sites, and click Sites. Add the URL of your mail server, starting with https://. This is not a recommended long-term solution for security.

Error Occurs Only with Specific Email Accounts

Create a new Outlook profile to rule out profile corruption. Search for Mail in the Windows Start menu and open the Mail (Microsoft Outlook) control panel. Click Show Profiles, then Add. Set up your account in the new profile. If the error disappears, your original profile was damaged.

Certificate Validation Methods in Outlook

Item	Standard Validation	Workaround (Not Recommended)
Primary Check	Server name matches certificate Subject or SAN	Adding server to Trusted Sites zone
Trust Anchor	Certificate chain leads to a trusted Root CA in Windows store	Manually installing the specific server certificate
Outcome	Secure, encrypted connection with verified identity	Connection works but with potential security risk
Best For	All permanent business and personal accounts	Temporary testing on a known, secure internal network

You can now connect to your mail server without the invalid certificate name warning. Ensure your system time is synchronized and the correct root certificates are installed. For ongoing management, ask your IT team about deploying certificates via Group Policy. A useful advanced tip is to use the certutil command in an administrator Command Prompt to verify a certificate’s details, such as running certutil -dump filename.cer to check the Subject Alternative Name field.