Fix 'Certificate Error' in Outlook When Connecting to Exchange

When This Error Shows Up

You open Outlook (2016, 2019, or Microsoft 365) on Windows 10 or 11. You get a popup saying something like "There is a problem with the proxy server's security certificate" or "Outlook cannot verify the certificate." Error code 0x800B0100 often tags along. This usually happens right after your IT team renewed the Exchange server certificate, or when you connect from a coffee shop WiFi that messes with SSL.

Why It Happens

The root cause is simple: Outlook can't trust the server's SSL certificate. Three common triggers:

• The certificate expired (duh, someone forgot to renew).
• The certificate was issued for a different domain name than your mail server (like a mismatch after an upgrade).
• The certificate was issued by a Certificate Authority (CA) that your computer doesn't recognize — common with internal company CAs.

No conspiracy here. Just a boring cert problem.

The Fix — Step by Step

Step 1: Check the Certificate Date

1. Open Outlook and click the certificate error notification.
2. Click View Certificate. Look at the Valid From and Valid To dates.
3. If the current date is outside that range, the cert is expired. Tell your IT team to renew it. If you're the IT team, see Step 3.

For example, if it says valid from 01/01/2023 to 01/01/2024, and today is June 2024 — yep, expired.

Step 2: Verify the Domain Name

1. In the same certificate window, find the Issued To field (or Subject).
2. It should match your mail server's FQDN, like mail.yourcompany.com.
3. If it shows a different name, like oldserver.yourcompany.com, then the certificate is for the wrong server. The real fix is to get a cert that matches your current server name.

Step 3: Fix a Mismatched or Expired Cert on Exchange (for IT folks)

If you manage the Exchange server, here's what you do:

1. Open Exchange Management Shell (run as admin).
2. Run Get-ExchangeCertificate | fl to list all certificates.
3. Find the one about to expire or with a wrong name. Note its Thumbprint.
4. To create a new self-signed cert (if you don't have a public CA):

   New-ExchangeCertificate -GenerateRequest -DomainName mail.yourcompany.com, autodiscover.yourcompany.com -PrivateKeyExportable $true

   Swap mail.yourcompany.com for your actual domain.

5. Then run Enable-ExchangeCertificate -Thumbprint <thumbprint> -Services SMTP, IIS, IMAP, POP to assign it to services.
6. Restart IIS and the Exchange services: iisreset /restart and then net stop w3svc && net start w3svc.

Step 4: Trust a Self-Signed or Internal CA Cert

If your company uses its own CA, Outlook won't trust it by default. You need to install the root CA certificate on the user's machine.

1. On the Exchange server, export the root CA cert (not the server cert).
2. Copy the .cer file to the user's Windows machine.
3. Open Certmgr.msc (Windows key + R, type certmgr.msc).
4. Go to Trusted Root Certification Authorities > Certificates.
5. Right-click, choose All Tasks > Import. Browse to the .cer file, place it in the Trusted Root store.
6. Restart Outlook. The error should vanish.

Heads up: If your company uses Group Policy, push the root cert via GPO instead of doing it manually on 200 machines. Save your sanity.

Step 5: Clear Outlook's SSL Cache (weird fix that works)

I've seen Outlook hold onto a bad cert in its cache. Kill it:

1. Close Outlook.
2. Open Internet Options (Control Panel).
3. Go to Content tab > Clear SSL state.
4. Also go to General tab > Browsing History > Delete — check Temporary Internet Files and Cookies.
5. Restart Outlook.

When It Still Fails

If the error sticks around after all that, check these:

• Check the date and time on your computer. If it's off by more than a few minutes, SSL handshake fails. Fix from Settings > Time & Language.
• Try a different network. Some public WiFis (hotels, airports) inject their own certs and break things.
• Update Outlook. Run Office updates. Old versions have buggy SSL handling.
• Worst case: Delete and recreate the email profile in Control Panel > Mail > Show Profiles. This nukes all cached settings, including any corrupt cert info.

Cert errors are boring but fixable. You got this.