Certificates Flagged as Invalid

Question

Good afternoon, 
 Recently I had to redo the certificates for Exchange 2013. I got the certificate from the Exchange Server and then uploaded it to the UTM. I also had user certificates that were expired, so I went to regenerate them and they still showed as expired. I then removed the user certificates leaving the local x.509 and the exchange certificate. Since then I have been getting DLG_Flags_Invalid_CA. DLG_Flags_Sec_Cert_CN_Invalid. If I check the user profiles the CA is in the trusted root of the User and Computer certificates for each machine. So I shouldn't be getting CA invalid. Though if I look at Certificate Authorities Tab in Sophos UTM, the Root CA and Issuing CA show as "This object is unused." and "This object is not used by any other objects." That I ended up doing something wrong is not a new thought to me, but I am unsure of how to fix it. Would appreciate any thoughts.

Thanks, 
 Mike

DouglasFoster · Answer

Secure communication requires (a) talking to the right system, and (b) talking to it with encryption. So the first step in a TLS session is confirming identity -- the browser verifies that the host identifier that you entered matches at least one of the host names returned in the server certificate. It also does other verifications, include date range, certificate purpose, and signature chain leading back to a root certificate that was pre-installed on your client device. 
 Your error message says that the names do not match. Certificate names are always fully qualified, so if you connect with an unqualified host name, you will see this error. Similarly, if you connect using an IP address, you will see this error. With a multiple-SAN certificate, UTM forces you to specify the name that it should offer when you configure the WAF site, so you must use the one FQDN that you configured into the UTM Virtual webserver. 
 You need to ensure that you have a name match for both client-to-WAF and WAF-to-Exchange connections. You don't have to use the same FQDN for both connections, but it is harder to make a mistake if you keep them the same. At minimum, the client and server side of each connection must use the same FQDN.