Tests pass, but iPhone won't autodiscover Exchange 2010.

Question

I have some Exchange 2007 and one Exchange 2010 I am responsible for. As far as I can tell I have ActiveSync and AutoDiscover setup properly. Running the tests here confirms this. With an iPhone I am able to do the "one step autodiscovery" on the Exchange 2007 servers but the Exchange 2010 does the "two step setup" where it fails to get the server name and it has to be put in by hand.
I'm curious if something was changed in 2010 AutoDiscover that breaks iPhone (3G 3.1.2). More likely I have got something misconfigured.
All the DNS names point to the same server, the SSL certificate supports all the names.
Here is my ActiveSync test results against the 2010 server.
Testing Exchange ActiveSync
 Exchange ActiveSync was tested successfully
 Test Steps
 Attempting AutoDiscover and Exchange ActiveSync Test (if requested)
 Successfully tested AutoDiscover for Exchange ActiveSync
 Test Steps
 Attempting each method of contacting the AutoDiscover Service
 The AutoDiscover Service was successfully tested.
 Test Steps
 Attempting to test potential AutoDiscover URL https://pepper.net/AutoDiscover/AutoDiscover.xml
 Failed testing this potential AutoDiscover URL
 Test Steps
 Attempting to resolve the host name pepper.net in DNS.
 Host successfully resolved
 Additional Details
 IP(s) returned: 69.85.246.35
Testing TCP Port 443 on host pepper.net to ensure it is listening and open.
 The specified port is either blocked, not listening, or not producing the expected response.
  Tell me more about this issue and how to resolve it
 Additional Details
 A network error occurred while communicating with remote host
Exception Details:
Message: No connection could be made because the target machine actively refused it 69.85.246.35:443
Type: System.Net.Sockets.SocketException
Stack Trace:
at System.Net.Sockets.TcpClient.Connect(String hostname, Int32 port)
at Microsoft.Exchange.Tools.ExRca.Tests.TcpPortTest.PerformTestReally()
Attempting to test potential AutoDiscover URL https://autodiscover.pepper.net/AutoDiscover/AutoDiscover.xml
 Testing AutoDiscover URL succeeded
 Test Steps
 Attempting to resolve the host name autodiscover.pepper.net in DNS.
 Host successfully resolved
 Additional Details
 IP(s) returned: 69.57.51.22
Testing TCP Port 443 on host autodiscover.pepper.net to ensure it is listening and open.
 The port was opened successfully.
Testing SSL Certificate for validity.
 The certificate passed all validation requirements.
 Test Steps
 Validating certificate name
 Successfully validated the certificate name
 Additional Details
 Found hostname autodiscover.pepper.net in Certificate Subject Alternative Name entry
Testing certificate date to ensure validity
 Date Validation passed. The certificate is not expired.
 Additional Details
 Certificate is valid: NotBefore = 11/25/2009 1:15:23 PM, NotAfter = 11/26/2011 3:33:48 AM"
Attempting to send AutoDiscover POST request to potential autodiscover URLs.
 Successfully Retrieved AutoDiscover Settings by sending AutoDiscover POST.
 Test Steps
 Attempting to Retrieve XML AutoDiscover Response from url https://autodiscover.pepper.net/AutoDiscover/AutoDiscover.xml for user [email protected]
 Successfully Retrieved AutoDiscover XML Response
 Additional Details
 AutoDiscover Account Settings
XML Response:
<?xml version="1.0"?>
<Autodiscover xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
<Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/mobilesync/responseschema/2006">
<Culture>en:us</Culture>
<User>
<DisplayName>test user</DisplayName>
<EMailAddress>[email protected]</EMailAddress>
</User>
<Action>
<Settings>
<Server>
<Type>MobileSync</Type>
<Url>https://webmail.pepper.net/Microsoft-Server-ActiveSync/</Url>
<Name>https://webmail.pepper.net/Microsoft-Server-ActiveSync/</Name>
</Server>
</Settings>
</Action>
</Response>
</Autodiscover>
Validating Exchange ActiveSync settings
 ActiveSync URL https://webmail.pepper.net/Microsoft-Server-ActiveSync/ was successfully validated
Attempting to resolve the host name webmail.pepper.net in DNS.
 Host successfully resolved
 Additional Details
 IP(s) returned: 69.57.51.22
Testing TCP Port 443 on host webmail.pepper.net to ensure it is listening and open.
 The port was opened successfully.
Testing SSL Certificate for validity.
 The certificate passed all validation requirements.
 Test Steps
 Validating certificate name
 Successfully validated the certificate name
 Additional Details
 Found hostname webmail.pepper.net in Certificate Subject Alternative Name entry
Testing certificate date to ensure validity
 Date Validation passed. The certificate is not expired.
 Additional Details
 Certificate is valid: NotBefore = 11/25/2009 1:15:23 PM, NotAfter = 11/26/2011 3:33:48 AM"
Testing Http Authentication Methods for URL https://webmail.pepper.net/Microsoft-Server-ActiveSync/
 Http Authentication Methods are correct
 Additional Details
 Found all expected authentication methods and no disallowed methods. Methods Found: Basic
Attempting an ActiveSync session with server
 Testing an ActiveSync session completed successfully
 Test Steps
 Attempting to send OPTIONS command to server
 OPTIONS response was successfully received and is valid
 Additional Details
 Headers received: Allow: OPTIONS,POST
MS-Server-ActiveSync: 14.0
MS-ASProtocolVersions: 2.0,2.1,2.5,12.0,12.1,14.0
MS-ASProtocolCommands: Sync,SendMail,SmartForward,SmartReply,GetAttachment,GetHierarchy,CreateCollection,DeleteCollection,MoveCollection,FolderSync,FolderCreate,FolderDelete,FolderUpdate,MoveItems,GetItemEstimate,MeetingResponse,Search,Settings,Ping,ItemOperations,Provision,ResolveRecipients,ValidateCert
Public: OPTIONS,POST
Content-Length: 0
Cache-Control: private
Date: Fri, 05 Feb 2010 05:11:05 GMT
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Attempting FolderSync command on ActiveSync session
 FolderSync command completed successfully.
 Additional Details
 Number of Folders: 11
Attempting initial sync (no data) for Inbox folder
 Completed Sync Command successfully
 Additional Details
 Status: 1
Attempting to test GetItemEstimate command for Inbox Folder
 Successfully received GetItemEstimate Response from Server
 Additional Details
 Estimate: 2 messages
Attempting to test Sync of Inbox Folder
 Completed Sync Command successfully
 Additional Details
 Number of items synchronized: 2

Answer 1

http://www.experts-exchange.com/Apple/Hardware/iPhone/Q_24933916.html 
Demazter:
Check the security tab of the users in AD and see if inherit permissions is checked.
had a similar problem with my first migration to Exchange 2010 and it was down to a security permission on the Active Directory User account.
In Active Directory Users and Computers right click on the user and select properties then under the security tab and advanced make sure the box is checked for inheritable permissions.
=========================
dmlavigne1:
Demazter is right for existing users that have been upgraded from previous versions of Exchange.  If you create a new user in Exchange 2010 IPhone sync will work without additional steps.  
When I went to check the security tab in AD, it was not visible.  I had to click the View menu then place a check beside Advanced Features.
When I checked the inheritable box, IPhone Sync worked for that existing user.
Note, I checked other users in my AD with mailboxes and some of them had this already checked.  The only two that didn't have this box checked were the users that were using the IPhone syncing and were upgraded from Exchange 2007.