Why is hotmail mail server providing an invalid certificate?

Question

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com is using a TLS certificate issued to mail.protection.outlook.com.

Both the mail server hostname and TLS certificate common name belong to the same subdomain: protection.outlook.com

I'm trying to understand what's happening. Am I expected to ignore this kind of name mismatch?

This report seems to point out that there's something wrong:

Edit 2018-08-04

Report link: https://ssl-tools.net/mailservers/hotmail.com

Answer 1

It's currently fixed (2020-01-11), Certificate chain is valid:

mail.protection.outlook.com
128 days remaining / 2048 bit / sha256WithRSAEncryption

---

GlobalSign Organization Validation CA - SHA256 - G3
2062 days remaining / 2048 bit / sha256WithRSAEncryption

---

GlobalSign Root CA (Certificate is self-signed.)
2939 days remaining / 2048 bit / sha1WithRSAEncryption

Report:

• https://ssl-tools.net/mailservers/hotmail-com.olc.protection.outlook.com

🙂

Answer 2

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com

How often do you send messages to (mailbox)@hotmail-com.olc.protection.outlook.com?

Where did you get hotmail-com.olc.protection.outlook.com from?

The certificate needs to match the MX record for the domain. When I check:

 $ nslookup
 > set type=MX
 > outlook.com
 Server:         127.0.1.1
 Address:        127.0.1.1#53

 Non-authoritative answer:
 outlook.com     mail exchanger = 5 outlook-com.olc.protection.outlook.com.

Unfortunately Thomas left off the part of the screen shot which explains why the certificate presented there is valid - it is because one of the subject alternate names is *.olc.protection.outlook.com which also matches the address you cited.