SSL Certificate Warning - Office 365 / Exchange Online and CloudFlare
Email warning popup relating to SSL and cannot verify the server identity message when using Outlook Apple Mail iPhone email

SSL Certificate Warning – Office 365 / Exchange Online and CloudFlare


Symptoms

  • Your device connects to your Office 365 / Exchange Online email account
  • The device pops up a security or SSL certificate warning complaining of:
    • an invalid name
    • “Cannot Verify Server Identity”
    • “A secure connection could not be established with the server”
    • or equivalent message
  • When you view the certificate details, you’re being issued an SSL certificate in the name of CloudFlare (cloudflare-dns.com)
  • You now scratch your head and wonder why CloudFlare is issuing certificates when you’re trying to talk to Microsoft Office 365

 

Cause and Remedy for SSL Certificate Warnings

CloudFlare is nothing to do with Office 365. So the question is, why does CloudFlare return a certificate when you were trying to communicate with Microsoft?

CloudFlare provide DNS services. Without technical detail, this is basically what makes the internet work, in the way most people understand and use it. DNS ensures that all your internet traffic reaches the correct destinations.

CloudFlare offers a service called DNS Proxying. In simple terms, it intercepts all requests to your domain (e.g your website). It then forwards them on to your web server if they look legitimate. So, any malicious attacks involving a denial-of-service for example (a big flood of traffic designed to stop your website from working) do NOT hit your website directly. They are hoovered up by CloudFlare and blocked.

If your nameservers are with CloudFlare (ask your IT people), you should log into CloudFlare and check to see if the autodiscover “A” record is being proxied. If so, CloudFlare is intercepting any requests by your device when it attempts to use this vital Microsoft autodiscover process, and passes it through to Microsoft. CloudFlare acts as a proxy.

This explains why you get a mismatch on the certificate and how CloudFlare is mysteriously getting in the way, even though we’re trying to talk to Microsoft. To be fair, it seems that most of the time it’s seamless and works fine anyway. But if you get repeated password prompts in Outlook or any kind of SSL certificate / security warning about an invalid certificate or mismatched name, this is likely to be the cause.

Since you don’t care if Microsoft receives a DoS attack, as it’s not your problem, it’s fine to turn off proxying for the autodiscover record on its own. This means that when your device attempts to retrieve email, it talks to the autodiscover service. But Cloudflare doesn’t intercept that request and hence you don’t get the SSL warning.

Real-Time Feedback

When we solve a support ticket, clients are given the choice of leaving good or bad feedback along with an optional comment. We post the 10 most recent comments here automatically and in real-time. You can view even more on our page.

Date Name Comments
Jul 3rd Sally & Quick and efficient resolution - Thank you Lochie
Jul 2nd Lindsay P Thanks - all you need in one phone call. Reassurance you're not an idiot, quick fixing of glitches and totally professional service....
Jul 2nd Emily C Quick and efficient service as always, thank you
Jun 18th Alexandra N As always, the team at Purple are knowledgeable, efficient and a pleasure to work with.
Jun 16th Caron G Its like having a new machine. thank you!
Jun 4th Amanda H Thanks for helping me so quickly.
May 20th Richard C Quick and easy solution.
May 15th Ed W Speedy resolution, good communication.
May 15th Lynn H Really great immediate response. Very comprehensive explanation of the spoof email problem. Many thanks for understanding the issue and resolving so quickly.
May 15th Lou M Sorted the problem quickly and offered great reassurance for my anxious mind. Really pleased it’s been resolved.