This hard to understand error means the security certificate your email server is using has expired or is invalid for other reasons.
I'm getting a security warning when I open Outlook. It says: 'The server you connected to is using a security certificate that cannot be verified. A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the file'
That message is saying that the certificate the mail server uses has likely expired.
If you are the administrator, you need to install an updated certificate; if you are an end-user, you need to speak to your admin. You can't hide the warning or turn it off, but in all likelihood, it's safe to OK it and connect to your mail server.
The message made perfect sense to me but not to the people who asked about it, so I asked a couple of family members who aren't into technology what they thought the message was trying to tell them and what they would do if it came up while they were on the computer. Their answer: it "hurt" to read it and they'd ask me to look at it. I guess that proves it's a poorly written, overly technical error message.
Target Principle name is incorrect
I have a SSL IMAP email account that I just setup in Outlook. Every time I run the program I get a popup: "Internet Security Warning" The server you are connected to is using a security certificate that cannot be verified. The target principle name is incorrect. View Certificate. The certificate is self signed so I always just click Yes to continue using the server/email account, but how do I get Outlook to remember?
This warning indicates the server name does not match the name in your account settings, or in the case of Exchange server, that the address in the autodiscover file does not match the address the server is using. This is a common problem when the administrator uses self-published certificates.
If you can't change the server name you use in Outlook, you can publish the certificate in the Certificate store to reduce the frequency of the alert. In the Trusted Publishers folder should suffice or use the automatic setting. This probably won't totally eliminate the dialog, but you'll see it less often, usually only when you restart Outlook.
To publish the certificate, click View Certificate then Install Certificate. Choose Current user, click Nest then Install.
For example, in the dialog in this screenshot, the server certificate was issued to pop.secureserver.net but I'm using mail.mydomain.com as the server name in my account settings.
John Roper-Lindsay uses these steps:
You can get around the "Target Principal Name is incorrect" by following the steps below:
- Open a cmd prompt and ping your incoming mail server to get the IP address - e.g. ping mail.fred.com returns IP address like 126.96.36.199
- View the certificate as above and note the server name under Issued To.
e.g. elephant.giraffe.co.nz or *.giraffe.co.nz
- Edit the hosts file and add a new line for IP address 188.8.131.52. The hosts file is in %windir%system32driversetc and you will probably need to edit this as administrator.
The entry you create in the hosts file should look something like this.
- Edit Outlook account settings and change the incoming and outgoing mail server to elephant.giraffe.co.nz
What does this do? Basically your mail server name needs to match the name on the certificate or Outlook will complain. The above process changes the mail server name to the name on the certificate and the hosts file will ensure that mail traffic to this server name will be correctly directed to your mail server.
NOTE: - Before editing the hosts file, you could test a ping to elephant.giraffe.co.nz and if the IP address matches your mail server's IP address you won't need to touch the hosts file.
NOTE:- If the certificate name is wildcarded, i.e. *.giraffe.co.nz, you could create a hosts file entry of anything.giraffe.co.nz, as the wildcard will cover anything.
NOTE:- you won't need to trust the certificate anywhere, as long as your mail provider is using a valid Certificate Authority to issue the certificate, which they certainly should be.
NOTE: This assumes the incoming and outgoing mail servers are the same. If they're not you may have to fiddle around with 2 server names.