Activesync broken after upgrade to iOS 10.2

Question

Level 1

11 points

Activesync broken after upgrade to iOS 10.2

Dear All,

I have an own Exchange 2010 server and all our iOS devices are configured for it. I have an iPhone 7, iPad Pro and iPad Pro 12.9.

Yesterday I upgraded my iPad Pro 12.9 to 10.2. The upgrade went well, but now my email refuse to synch with the server. It returns the message "Cannot get mail, the connection to the server failed". M iPhone 7 and the other iPad still on the previous iOS version are synching fine. What I did I also upgrade my iPhone 7 and iPad Pro to iOS 10.2. What happened then is the same problem. It cannot longer sync with my exchange account.

I tried a few things like reset network settings or disabling wireless on my iPhone 7 to be only on cellular. I also re-created the email account several times with no luck..

I had another old iPad around which has never setup my email account before. The iPad had still iOS 9 installed. So I was thinking maybe there is a problem with ActiveSync and installed my email onto this iPad. It worked straight away. Then I went ahead and upgraded this iPad to iOS 10.2 and now it stopped working too. With this iPad I did a full reset and deployed it as a new iPad again which has now iOS 10.2, but I was not able to verify my Exchange account.

My family has iPads and iPhones too, but not yet at level iOS 10.2 and they are all working.

I suspect Apple changed something in iOS 10.2 with the ActiveSync protocol which does not like my Exchange server anymore.

BTW: I have also an Android table and it works still fine with my Exchange email account.

Any hint is highly appreciated!

Thank you!

iMac, OS X Mountain Lion (10.8.4)

Posted on Dec 18, 2016 3:01 AM

Reply

Answer 1

Aug 2, 2017 7:46 AM in response to deejerydoo

Hi deejerydoo. Do you maybe have a certificate problem? This link: Lists of available trusted root certificates in iOS - Apple Support shows the accepted root certificates. If you're self-signing, this link: iOS 10 and self signed certificates – Freddys Blog may help.

Reply

Answer 2

carogoff

Level 1

8 points

Jan 13, 2017 12:15 PM in response to Diana.McCall

FYI, that tool does not list iOS 10.2. I was on the phone with a tier 2 tech today who exhausted all of his resources and elevated the case to Engineering. I am supposedly going to receive a call within 2 business days.

Reply

Answer 3

fafa24 Author

Level 1

11 points

Jan 14, 2017 2:30 AM in response to carogoff

Well it was the certificate in my case from StartSSL which is no longer accepted with iOS 10.2. I bought a certificate from Digicert.com and and immediately after I applied it to my Exchange server the emails were delivered again to the iOS devices.

Thanks,

Reply

Answer 4

TimRee

Level 1

4 points

Jun 12, 2017 2:00 AM in response to fafa24

Did you ever receive an answer to this question? There appears to be common issues with active sync and the native calendar app. Microsoft rejects responsibility and offers the work-around of using the native Outlook app but not a very practical option.

https://support.microsoft.com/en-us/help/2563324/current-issues-with-microsoft-e xchange-activesync-and-third-party-devices

I would highly appreciate any further information you may have !

Thanks

Reply

Answer 5

Aug 2, 2017 7:20 AM in response to fafa24

I am also having this problem. I have Exchange 2010 (patched) and cannot connect Outlook for iOS any longer. It used to work just fine but stopped around the time iOS 10 came out and one of the frequent Outlook for iOS updates were applied. Apple Mail, on my phone, works just fine and the Microsoft Remote Connectivity Analyzer passes its ActiveSync tests.

This is exactly the same for a couple of Exchange 2010 systems I administer.

Reply

Answer 6

Aug 2, 2017 9:38 PM in response to Diana.McCall

Hi Diana,

Thanks for your response and suggestion. Of the two systems, I am experiencing this issue with, one is using Go Daddy and the other is using DigiCert. So, these both have root certs listed, on the Apple site. However, there are differences in the certs listed on the site and the root certs given in the certs I am using:

Go Daddy Root Cert: Same name and serial number as mine, (Go Daddy Root Certificate Authority - G2 SN: 00) but a different thumbprint and expiry date.

DigiCert: Same name, (DigiCert Global Root CA) but everything else is different.

So, the upshot, I guess, is that the root certs are close, but no prize!

Any suggestions on what I need to do to establish the correct root authorities?

Cheers,

Deejerydoo

Reply

Answer 7

Aug 2, 2017 10:00 PM in response to deejerydoo

Hi Diana,

Because Apple Mail, on the iOS devices, is working just fine, and it's only Outlook for iOS that's baulking; this suggests to me that the issue isn't to do with the iOS root certificate changes. However, I may be wrong.

In the meantime, it appears the Outlook for iOS connectivity, using the Go Daddy certs, has started working. This is without me making any changes, so this must have been down to some other issue. The fact that the root certs I am using, in my Go Daddy cert and the Go Daddy root cert, given on the Apple Web site, don't match exactly is intriguing/confusing.

Any suggestions on what I need to do to establish the root authorities for DigiCert, still?

Cheers,

Deejerydoo

Reply

Answer 8

Aug 3, 2017 3:55 AM in response to deejerydoo

As you say, it sounds more like a device configuration problem than a certificate problem.

Is the balky Outlook on the same device as the working Mail app?

Do you use Profiles for these accounts?

Can you delete the account in Outlook, then add it again?

Reply

Answer 9

RobinVer

Level 1

4 points

Dec 19, 2016 4:35 AM in response to fafa24

Same issue here.

Problem is that EAS policy is not applied anymore and the devices doesn't sync anymore with Exchange (On Premise or Online)

Any ETA on fix time for this ?

Reply

Answer 10

Dec 19, 2016 8:40 AM in response to RobinVer

Hi. First, you should try posting this here iPad in Business and Education, since it's more of a business question. Second, you can report the problems here https://www.apple.com/feedback/ipad.html. Apple doesn't follow these forums.

Reply

Answer 11

ShagCA

Level 5

6,353 points

Dec 19, 2016 9:57 AM in response to fafa24

Make sure that you have not exceeded the number of allowed (mobile device) clients. Sign in through outlook web interface to check for the setting. Click Options (I'm still on 2007. It may be different on newer Exchange server) - Mobile Devices. It looks like this:

Reply

Answer 12

fafa24 Author

Level 1

11 points

Dec 19, 2016 11:10 AM in response to ShagCA

First of all I'm glad it is not only me. I have applied to the Apple Beta program and installed iOS 10.2.1 to one of my device. But it is not fixed yet.

Yes I also think it has something to do with the policy not applied.

Second, I do not think this is a business related question only since hosted exchange mailbox is not only for business.

I will send Apple a feedback using the form above.

Thanks

Reply

Answer 13

Dec 19, 2016 11:21 AM in response to fafa24

I agree that it's not a business only question. But I believe there are a lot more business IT managers dealing with Exchange servers than there are home users. So posting in the business forum might get more results.

Reply

Answer 14

fafa24 Author

Level 1

11 points

Dec 19, 2016 11:29 AM in response to Diana.McCall

Okay I posted almost the same in the business forum.

Reply

Answer 15

Dec 19, 2016 2:10 PM in response to fafa24

Had this issue today as well.

Turns out that Apple and others are starting to block StartSSL certificates: Lists of available trusted root certificates in iOS - Apple Support

Have replaced the certificate with one from RapidSSL and mail sync is working for me again.

Edit: I was not able to load the Outlook Web Access / SBS 2011 page in Safari either until I replaced the certificate.

Reply