SSL Certificate Warning | Office 365 / Exchange & CloudFlare
Email warning popup relating to SSL and cannot verify the server identity message when using Outlook Apple Mail iPhone email

SSL Certificate Warning – Office 365 / Exchange Online and CloudFlare


Symptoms

  • Your device connects to your Office 365 / Exchange Online email account
  • The device pops up a security or SSL certificate warning complaining of:
    • an invalid name
    • “Cannot Verify Server Identity”
    • “A secure connection could not be established with the server”
    • or equivalent message
  • When you view the certificate details, you’re being issued an SSL certificate in the name of CloudFlare (cloudflare-dns.com)
  • You now scratch your head and wonder why CloudFlare is issuing certificates when you’re trying to talk to Microsoft Office 365

 

Cause and Remedy for SSL Certificate Warnings

CloudFlare is nothing to do with Office 365. So the question is, why does CloudFlare return a certificate when you were trying to communicate with Microsoft?

CloudFlare provide DNS services. Without technical detail, this is basically what makes the internet work, in the way most people understand and use it. DNS ensures that all your internet traffic reaches the correct destinations.

CloudFlare offers a service called DNS Proxying. In simple terms, it intercepts all requests to your domain (e.g your website). It then forwards them on to your web server if they look legitimate. So, any malicious attacks involving a denial-of-service for example (a big flood of traffic designed to stop your website from working) do NOT hit your website directly. They are hoovered up by CloudFlare and blocked.

If your nameservers are with CloudFlare (ask your IT people), you should log into CloudFlare and check to see if the autodiscover “A” record is being proxied. If so, CloudFlare is intercepting any requests by your device when it attempts to use this vital Microsoft autodiscover process, and passes it through to Microsoft. CloudFlare acts as a proxy.

This explains why you get a mismatch on the certificate and how CloudFlare is mysteriously getting in the way, even though we’re trying to talk to Microsoft. To be fair, it seems that most of the time it’s seamless and works fine anyway. But if you get repeated password prompts in Outlook or any kind of SSL certificate / security warning about an invalid certificate or mismatched name, this is likely to be the cause.

Since you don’t care if Microsoft receives a DoS attack, as it’s not your problem, it’s fine to turn off proxying for the autodiscover record on its own. This means that when your device attempts to retrieve email, it talks to the autodiscover service. But Cloudflare doesn’t intercept that request and hence you don’t get the SSL warning.

Real-Time Feedback

When we solve a support ticket, clients are given the choice of leaving good or bad feedback along with an optional comment. We post the 10 most recent comments here automatically and in real-time. You can view even more on our page.

Date Name Comments
Jun 12th Simon D Great service - got the programme working A+
Jun 10th Helen W Alex was great - sorted all the issues and got me back up and running
Jun 6th Darlene F The support received from Jack today was above and beyond my satisfaction. Great work! Thank you! Have a lovely rest of this day. We appreciate YOU! :-)
Jun 6th Niamh O Thanks for the speedy response/ help
Jun 2nd Bill S I was totally locked out and out of my depth with office 365 and outlook. I tried everything. Dean fixed it, got me up and running, (and on a weekend no less) and I am supremely grateful. Your Toronto staff rules!
May 30th Andy W Awesome, super fast response as it was an urgent requirement, thank you guys
May 29th Mark H As ever a quick response and problem sorted ... thanks Lochie!
May 22nd Georgina H Great service, as always from Purple. Thanks guys!
May 15th Salaheddin A Thank you very much for the clear communication, the helpful information, and for being professionals, thank you.
May 14th Amanda H Lots of advice and help with my iPhone.