Outlook 2010 Certificate does not match

Question

I have a problem with a new installation of Exchange 2013 on a Windows 2012 Server.  Most of the clients are Outlook 2010.
All the internal users are getting the error message:
"There is a problem with the proxy server's certificate. The name on the security certificate is invalid or does not match the name of the target site exchange2013.myinternaldomain.local
This is shortly followed by another box "the name on the security certificate is invalid or does not match the name of the site"
Of course the issue is my purchased SSL certificate is MAIL.REALDOMAIN.ORG  while the server's name is exchange2013.myinternaldomain.local
With Exchange 2010 servers I have deployed I have had success following KB article 940726 but this time it didn't fix it with Exchange 2013.
There must be a solution!
I found this article:
http://support.microsoft.com/kb/2783881   the first suggestion from MS were impractical and the registry edit didn't work either (plus the thought of going to all my clients to do a registry
fix doesn't make me happy!)
I tried creating a local DNS zone for my external domain name and pointing to the internal IP but that didn't fix it.
In the ECP under the Outlook Anywhere section --  "*Specify the internal host name such as contoso.com that users will use to connect
to your organization:"  I changed the internal host name to the external .org address but this caused Outlook clients internally not to work.
I used the -AutodiscoverServiceInternalUrl command to point it to the .org address on the certificate but didn't work either.
I have a service record in both external and internal DNS pointing to the mail.realdomain.org address.
Any other suggestions?
Thanks in advance!
Mike

Answer 1

Thanks for the information. I actually finally got this resolved a few weeks ago by speaking directly with a Microsoft technician. I am going to post what finally fixed my problem with the hopes that it will help others in my position.
Again, the problem which I am sure is common is a .local domain internally and a "real" domain on the outside.  The solution that the MS tech had me do was to simply point EVERYTHING both internally and externally to the external host name - the one that
matched the certificate I had.
I'm surprised this solution isn't found elsewhere - it seems so obvious. 
He had me run an number of commandlets which I will post here - with the caveat that they were for my environment! (I've masked my real domain name and substituted - mydomainame.org)
Set-Webservicesvirtualdirectory -Identity "EXCHANGE2013\ews (Default Web Site)" -InternalURl
https://mail.mydomainname.org/ews/exchange.asmx
Set-OutlookProvider EXCH -CertPrincipalName msstd:mail.mydomainname.org
Set-OutlookProvider EXPR -CertPrincipalName msstd:mail.mydomainname.org
Set-OutlookAnywhere -Identity "EXCHANGE2013\Rpc (Default Web Site)" -InternalHostName "mail.mydomainname.org" -InternalClientsRequireSsl $True -InternalClientAuthenticationMethod NTLM
Set-Webservicesvirtualdirectory -Identity "EXCHANGE2013\ews (Default Web Site)" -InternalURl
https://mail.mydomainname.org/ews/exchange.asmx
Set-OutlookAnywhere -Identity "EXCHANGE2013\Rpc (Default Web Site)" -ExternalHostName "mail.mydomainname.org" -ExternalClientsRequireSsl $True -InternalClientAuthenticationMethod NTLM  --ExternalClientAuthenticationMethod NTLM -IISAuthenticationMethods 
Basic, NTLM, Negotiate
Set-OutlookProvider EXCH -CertPrincipalName msstd:mail.mydomainname.org
Set-OutlookProvider EXPR -CertPrincipalName msstd:mail.mydomainname.org
Set-OutlookAnywhere -Identity "EXCHANGE2013\Rpc (Default Web Site)" -InternalHostName "mail.mydomainname.org" -InternalClientsRequireSsl $True -InternalClientAuthenticationMethod NTLM
The last thing we did was ADD in DNS on the internal DNS server the mail.mydomainname.org and point it my Exchange Server private IP (192.168.1.2)  If you do the whole host name and not just mydomainame.org it wont mess up access to say an external
website.
hope this helps!