5 Proven Fix for Outlook Certificate Error in Windows 11 & 10

Getting a certificate error while sending emails? Learn how to fix Outlook certificate errors with these 5 proven solutions for Windows 11 and Windows 10.

Are you getting a certificate warning when opening Microsoft Outlook or checking your emails? One common message is:

“The server you are connected to is using a security certificate that cannot be verified.”

This error can also appear as a “The name on the security certificate is invalid” message or a Certificate Error notification in Outlook’s status bar.

An Outlook certificate error usually means that Outlook cannot verify the identity of the mail server. This can happen when the configured server name does not match the SSL certificate, the certificate has expired, or a network firewall or proxy interferes with the secure connection. Incorrect Autodiscover settings and untrusted certificate authorities can also cause the warning.

Before changing your Outlook account settings, identify which certificate warning you’re seeing. The message can help narrow down the likely cause and guide you towards the right fix.

Quick Check: Which Outlook Certificate Error Are You Seeing?

Check the warning displayed in Outlook to identify the likely issue and where to start troubleshooting.

Outlook error or symptom	Likely cause	Start here
> “The server you are connected to is using a security certificate that cannot be verified.”	Certificate identity, validity, or trust issue.	Inspect the certificate and check your mail server settings.
> “The name on the security certificate is invalid or does not match the name of the site.”	Server hostname does not match a name listed in the certificate.	Verify the mail server hostname and certificate’s SAN entries.
> “The target principal name is incorrect.”	Possible Autodiscover or Exchange certificate mismatch.	Check the Autodiscover endpoint with your email or IT administrator.
> “The certificate is not from a trusted certifying authority.”	Untrusted issuer or incomplete certificate chain.	Verify the certificate issuer and trust chain.
> “The security certificate has expired or is not yet valid.”	Expired certificate or incorrect Windows date and time.	Check your Windows clock and the certificate’s validity dates.
Certificate Error appears with Disconnected in Outlook’s status bar.	Possible network, proxy, firewall, or mail server connection issue.	Check your internet connection and network restrictions.

Important: Don’t ignore the warning or install an unfamiliar certificate just to restore your email connection. First, verify that the certificate belongs to your email provider or organisation.

Also, remember that a valid certificate can list multiple hostnames under its Subject Alternative Name (SAN) entries, so its main Subject name does not always need to match the server name exactly.

Outlook Certificate Error Fix

Try the following troubleshooting methods to identify and resolve the cause of the Outlook security certificate error. Start with the basic checks before changing your email account or network settings.

1. Check Your Windows Date and Time and Inspect the Outlook Certificate

An incorrect Windows date, time, or time zone can make a valid SSL certificate appear expired or not yet valid. Before changing your Outlook settings, check your computer’s clock and inspect the certificate shown in the warning.

Step 1: Verify your Windows date and time.

Press Windows + I to open Settings.
Select Time & language > Date & time.
Turn on Set time automatically and Set time zone automatically, if available.
Check that the displayed date, time, and time zone are correct.
Restart Outlook and check whether the certificate warning appears again.

Step 2: Inspect the Outlook security certificate.

If the warning persists, open the certificate details from the Outlook warning window:

When the certificate warning appears, select View Certificate.
Open the certificate’s General or Details tab.
Check the Issued to or Subject information and look for the server hostname.
Review the Subject Alternative Name (SAN) entries to see which hostnames the certificate covers.
Check the Valid from and Valid to dates.
Open Certification Path to review the certificate issuer and trust chain.

Compare the certificate’s listed hostnames with the mail server Outlook is configured to use. Also, check whether the certificate is within its validity period and whether Windows trusts its issuing authority.

What should you do next?

If the Windows date or time is incorrect, correct it and reopen Outlook.
If the certificate is expired, your email provider or server administrator needs to renew it.
If the server hostname is missing from the certificate’s SAN entries, the provider or administrator needs to correct the server configuration or issue a certificate covering the correct hostname.
If the certificate authority is untrusted, ask your email provider or IT administrator to verify the certificate chain before installing anything.

Important: Do not accept or install a certificate simply because Outlook keeps displaying the warning. Installing a certificate cannot fix an incorrect hostname or an expired certificate. Only install an organisation-approved certificate when your IT administrator has verified its authenticity and confirmed that the issue is limited to certificate trust.

2. Verify Your Outlook Mail Server Settings and Use the Correct Secure Hostname

An incorrect incoming or outgoing mail server name can trigger an Outlook certificate error, even when the certificate itself is valid. This is common with custom-domain email accounts that use a server hostname not covered by the certificate.

Step 1: Open your Outlook account settings.

In classic Outlook for Windows:

Open Outlook and select File.
Go to Account Settings > Account Settings.
Select the affected email account and choose Change or Server Settings, depending on your Outlook version.

Step 2: Check your server details.

Compare the incoming server (IMAP or POP) and outgoing SMTP server names with the exact settings supplied by your email provider.

For example, an address such as you@yourdomain.com does not necessarily use mail.yourdomain.com as its secure mail server. Your hosting provider may require a shared hostname such as mail.hostingcompany.com instead.

Example: Your email address might use you@yourdomain.com, while your hosting provider requires mail.hostingcompany.com as the secure mail server hostname.

The hostname Outlook connects to must be covered by the server’s SSL certificate. Otherwise, Outlook may report a certificate name mismatch.

Also verify the provider’s recommended server ports and encryption settings, such as SSL/TLS or STARTTLS where supported. Save any confirmed corrections and restart Outlook.

If the settings are already correct: Contact your email provider. It may need to update the certificate to cover your custom hostname or confirm which secure server name you should use. For Exchange or business email, ask your IT administrator to check the server’s certificate configuration.

Important: Don’t guess server names, switch to random ports, or disable SSL/TLS encryption to bypass an Outlook security certificate warning. Use only settings confirmed by your provider or administrator.

3. Check Your Network, Firewall and Proxy Settings

Sometimes, an Outlook certificate error is caused by your network rather than your email account. A captive Wi-Fi login page, proxy server, firewall, or HTTPS inspection system can interrupt or alter the secure connection between Outlook and the mail server.

Start with these basic checks before changing any network security settings.

Step 1: Check your internet connection.

Open a web browser and visit a trusted website.
If you’re connected to public Wi-Fi, check whether a network sign-in page is waiting for you to accept its terms or log in.
Complete the required sign-in and reopen Outlook.
Restart Outlook and check whether the certificate warning disappears.

Step 2: Test a different trusted network.

Connect your computer to another trusted network, such as your home Wi-Fi or a mobile hotspot, and open Outlook again.

If Outlook works on the alternative network, the original network may be interfering with the secure connection.
If the certificate error persists across different networks, the issue may be related to Outlook, your mail server, or the certificate configuration.
If other devices on the same network also experience certificate warnings, contact your network administrator or internet service provider.

Step 3: Check firewall, proxy and HTTPS inspection settings.

On managed office networks, security systems may inspect encrypted traffic using HTTPS inspection (TLS decryption). In some configurations, the firewall or proxy presents a replacement certificate instead of allowing Outlook to see the mail server’s original certificate. If that replacement certificate is not trusted or correctly configured, Outlook may display a security warning.

Ask your IT administrator to check:

Proxy and firewall logs for blocked or intercepted Outlook connections.
HTTPS inspection or TLS decryption rules that may affect Microsoft 365 or your email provider.
DNS settings and network restrictions that could direct Outlook to an unexpected server.
Whether the organisation’s approved certificate authority and Microsoft 365 endpoint policies are configured correctly.

Important: Don’t disable Windows Defender Firewall, antivirus protection, or HTTPS inspection across your network just to remove the warning. Ask your administrator to identify the specific connection or inspection rule causing the problem and apply a verified correction.

If the certificate is being replaced by an approved corporate security system, your IT team should also verify that its certificate is trusted and correctly configured.

4. Fix Outlook Autodiscover and Exchange Certificate Mismatches

Microsoft Outlook Autodiscover automatically finds the connection settings and service endpoints needed for your email account. With Microsoft Exchange, it helps Outlook locate the correct server without requiring you to enter every connection detail manually.

However, incorrect Autodiscover DNS records or Exchange service URLs can send Outlook to an endpoint that presents a certificate for a different hostname. This can trigger the “The name on the security certificate is invalid” or “The target principal name is incorrect” warning, even when your main mail server settings appear correct.

Step 1: Check the Autodiscover endpoint.

If you use a work or school Exchange account, contact your IT administrator and ask them to verify:

The internal and external Autodiscover DNS records.
Whether the Autodiscover endpoint resolves to the correct Exchange server.
Whether the hostname Outlook reaches is included in the server certificate’s Subject Alternative Name (SAN) entries.
Whether the Exchange service URLs and certificate bindings use the expected hostnames.

For example, Outlook may try to connect to autodiscover.yourdomain.com, while the certificate only covers mail.yourdomain.com. Unless the certificate also covers the Autodiscover hostname, Outlook may report a name mismatch.

Step 2: Have your Exchange administrator verify the certificate configuration.

For on-premises Exchange environments, the administrator may need to correct the Autodiscover service configuration, update the relevant DNS record, or replace the SSL certificate with one that covers the required service hostnames.

Microsoft documents the Autodiscover certificate mismatch problem and the DNS and certificate configuration options in its Autodiscover mismatch troubleshooting guide and Exchange Autodiscover documentation.

Important: Don’t change Autodiscover DNS records, Exchange URLs, or registry settings just to suppress the warning. Incorrect changes can disrupt Outlook profile setup and other Exchange features. These corrections should be tested and applied by the email or Exchange administrator.

5. Create a New Outlook Profile to Test for Profile-Related Problems

If the Outlook certificate error persists after checking your server and network settings, test whether the issue is isolated to your existing Outlook profile. A new profile lets you check this without immediately changing or deleting your original setup.

Step 1: Open Outlook’s Mail settings.

Close Microsoft Outlook.
Press Windows + S, search for Control Panel, and open it.
Select Mail (Microsoft Outlook). You may need to switch Control Panel to its icon view.
Choose Show Profiles.

Step 2: Create a separate profile.

Select Add and enter a name, such as Outlook Test.
Follow the prompts to add your email account.
Complete the setup using your provider’s verified account settings.
Under When starting Microsoft Outlook, use this profile, select Prompt for a profile to be used.

Step 3: Test the new profile.

Open Outlook, select the new profile, and check whether the certificate warning returns.

The warning disappears: The original profile may have a local configuration or cache issue.
The warning remains: The cause is more likely related to the server certificate, mail configuration, or network—not the original profile.

Before removing your old profile: Keep it until you’ve confirmed that your emails and other important data are available in the new one.

Back up any PST files and check for locally stored or unsynchronised messages, which may not be available on the mail server.

You may also come across advice to delete Outlook’s local RoamCache folder at %localappdata%\Microsoft\Outlook. Treat this as an optional diagnostic, not a confirmed fix for a server-side certificate mismatch. Avoid deleting cached data or profile files unless you understand what they contain.

Important: Don’t delete your original profile or remove and re-add your email account as a first step. A separate test profile is safer and helps establish whether the problem is local to Outlook or needs attention from your email provider or IT administrator.

When Should You Contact Your Email Provider or IT Administrator?

Some Outlook certificate errors require changes to the mail server or network—not your Windows settings. Contact the team responsible for the affected service when the certificate is expired, the server hostname is incorrect, or the warning only occurs on a managed network.

Problem	Who to contact
Expired or invalid server certificate	Email hosting provider or mail server administrator
Certificate name mismatch	Email provider or domain administrator
Autodiscover or Exchange error	Exchange or Microsoft 365 administrator
Untrusted organisation certificate	Company IT or security administrator
Error only on an office network	Network or firewall administrator
Problem affects multiple users or devices	Email provider or organisation’s IT support

When reporting the issue, provide the exact Outlook error message, when it started, and the affected account type. You can also share non-sensitive certificate details, such as the hostname, issuer, and validity dates.

For a work or school account, contact your IT team. For a personal or custom-domain email account, contact your hosting provider and ask it to verify the certificate and secure mail server hostname.

Important: Never send passwords, private keys, or sensitive account information. Hide personal details in screenshots before sharing them with support.

Frequently Asked Questions About Outlook Certificate Errors

1. Can I Ignore an Outlook Security Certificate Warning?

No. The warning means Outlook cannot verify the mail server’s identity. Ignoring it or accepting an unfamiliar certificate can expose your email connection to security risks.

Verify the certificate with your email provider or IT administrator before proceeding.

2. Why Does Outlook Keep Showing a Certificate Error?

Outlook may repeatedly display a certificate error because the underlying issue remains unresolved. Common causes include an incorrect server hostname, an expired SSL certificate, an untrusted certificate authority, or incorrect Autodiscover settings. A proxy or firewall can also interfere with certificate validation.

3. Does an Outlook Certificate Error Prevent Sending or Receiving Emails?

It can. If Outlook cannot establish a trusted connection, it may fail to synchronise messages or send and receive emails. The impact depends on which connection is affected.

For example, an incoming mail server issue may prevent new messages from downloading, while an SMTP certificate problem may prevent outgoing emails.

4. Is an Outlook Certificate Error Caused by Windows or the Email Server?

It can originate from Windows, the email server, or the network.

An incorrect Windows clock or an untrusted certificate authority can cause a local problem. An expired certificate or hostname mismatch usually needs attention from the email provider or server administrator. A corporate proxy or firewall can also interfere with certificate validation.

Discover more from Izoate

Subscribe to get the latest posts sent to your email.