[System.Net.WebException]: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. Inner error [System.Security.Authentication.AuthenticationException]: The remote certificate is invalid according to the validation procedure.
There is generally three causes for this problem:
1) Name mismatch – make sure the site name matches exactly as it is in the cert. If there is a “Subject Alternative Name” (SAN) on the details tab, then make sure the name is in that list (note: subject name must also be included in the SAN). Some applications don’t supports SANs, but most do. Also note that site1 and site1.domain.com are not the same – this is the most common mistake.
2) Untrusted – you need to install the root certificate into the trusted root certificate store. If this app uses the Microsoft root store, you can check Certificates MMC to see if it shows up. If not, view the details of the certificate from the error box, go to the certification path tab and double click the topmost certificate, go to details tab and Copy to File button to export it, then from your saved copy you can import it to the trusted root store.
3) Expired or not yet valid – usually from the cert expiring – renew it. Can also happen if the time/time zone/date/year is off in the client OS – if this is ok, try also checking the same in BIOS.
Name mismatch is generally the one that catches people out. If you simply run Test-ActiveSyncConnectivity the Exchange 2010 server will not use a trusted URL on your SAN certificate. Make sure you specify the URL on the Test command for example:
Test-ActiveSyncConnectivity -URL “https://webmail.exchagnetechexpert.com/Microsoft-Server-ActiveSync”