Apple Mail mit Microsoft Exchange Server 2010 verbinden

24. June 2010

Mac OS X ships with out-of-the-box Microsoft Exchange Server support for version 2007 and above since a while now.

Despite this announcement and numerous, partially contradicting posts on various blogs we kept failing to set up exchange profiles on our Macs. Beforehand, it is worth mentioning that we already successfully connected all sorts of clients to our exchange server, among them even iPhones. Hence, we didn’t consider a network based or server side configuration issue as a possible cause.

Autodiscovery was also working, the Apple Mail profile wizard presumably successfully configured the exchange profile, but when syncing the account with the server the password dialog appeared again and again pretending that the login information specified was wrong.

Our first suspect was, that the certificate we used for the SSL connection was not accepted. Since the Macs are not part of the Windows domain, the domain controller certainly is not recognized as a root certificate authority, and as such the the Macs won’t trust the used certificate. Nevertheless, registering the root certificate on the Macs didn’t have any effect.

Neither the exchange server nor Apple Mail was particularly verbose in telling the actual reason, hence we were left off with trial & error. Anyways, sooner than expected we ran out of ideas and non of our attempts showed any progress on that issue. We switched from our heuristic approach to a more structured one, and once again Wireshark came to our rescue.

Rather quick we were able to see, that it actually were the authentication attempts that were failing on the server, synchronization hasn’t even begun yet. The cause for this was resolved as quickly as it was found. As per the default settings the exchange server only accepts integrated windows authentication as a valid authentication method, i.e. either NTLM or Kerberos authentication. Apple Mail apparently doesn’t like this much (interesting that iPhones do, on the other hand) and we had to enable basic authentication on the server as well. Since all data is SSL encrypted anyways, this isn’t much of a security issue, and we just went ahead and did that change.

Another connection attempt from the Mac immediately proofed success, Apple Mail started syncing data!