I rekeyed the cert with a Subject Alternative Name of server.internaldomain.local to match what the internal users use to reach the Exchange server, but still get the same errors. Yes, I ...