POP.Protocol Health

Question

Anyone else having POP healthset errors based on the fact that the local Exchange server name is not in the Certificate?  When the pop health check runs its connects and tests to its server name.  This causes a cert name mismatch because we did
not include the server names in the SAN of the cert as per MS Best Practice.  The ease fix would be to have the healthset check on 110 and not 995 but there seems to be no way to configure that port.
MonitorIdentity    : pop.protocol\popselftestprobe
RequestId          : c2465e93-a932-47aa-a494-f60577604b62
ExecutionStartTime : 12/9/2014 5:40:22 PM
ExecutionEndTime   : 12/9/2014 5:40:22 PM
Error              : Unexpected response to the POP USER command for user:
                     HealthMailbox586bc919034f4c53b9458c742cba74cf on port: 995 with SSL encryption
Exception          : System.InvalidOperationException: Unexpected response to the POP USER command for user:
                     HealthMailbox586bc919034f4c53b9458c742cba74cf on port: 995 with SSL encryption
                        at
                     Microsoft.Exchange.Monitoring.ActiveMonitoring.PopImap.Probes.TcpProbe.VerifyResponse(TcpResponse
                     response, String failureMessage)
                        at Microsoft.Exchange.Monitoring.ActiveMonitoring.PopImap.Probes.PopProbe.TestProtocol()
                        at Microsoft.Exchange.Monitoring.ActiveMonitoring.PopImap.Probes.TcpProbe.InvokeProbe(Boolean
                     skipLogin)
                        at
                     Microsoft.Exchange.Monitoring.ActiveMonitoring.PopImap.Probes.PopMailboxProbeSSL.StartProbe()
                        at System.Threading.Tasks.Task.Execute()

Answer 1

Hi Steve,
According to the error message above, I know that you got alert from POP.Protoal Healthset.
I notice that you have got an error message said, local Exchange server name is not in the Certificate, and you didn't put the Exchange server name into SAN certificate.
I think this is the root reason, more detailed error message without sensitive information would be helpful for the further troubleshooting.
Would do you like to tell me why don't put Exchange server name into SAN certificate?
If you have set the Exchange server host name (mail.domain.com) instead of CAS FQDN (cas.domain.com), we must put mail.domain.com into SAN.
Additionally, based on my knowledge, port: 995 is the port which POP with SSL encryption used.
Thanks
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Mavis Huang
TechNet Community Support