Mismatch of pin rules for domain

Question

I see some of those logs in my windows eventlog (Windows 10)

05/31/2017 07:44:03 AM
LogName=Application
SourceName=Microsoft-Windows-CAPI2
EventCode=4114
EventType=2
Type=Error
ComputerName=VIE-TABSI-VM.PSC.local
TaskCategory=The operation completed successfully.
OpCode=Info
RecordNumber=276382
Keywords=Classic
Message=Server: outlook.office365.com has unexpected certificates under trusted authority: <DigiCert> with thumbprint: A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436.

Mismatch of pin rules for domain: .office365.com with effective date: ‎Freitag, ‎14. ‎Oktober ‎2016 17:55:07 and sequence number: 01D2263355B57CAZ.

Certificates saved to: <C:\Users\tabsi\AppData\LocalLow\Microsoft\MismatchPinRuleCerts\EXCEL.EXE_outlook.office365.com.p7b>.

Does anybody know what kind of impact this message has? I am currently facing random connection problems with Outlook and random crashes with Excel.

Here is the agregated list of errors in the eventlog from the last 7 days:

Message count   percent
Server: outlook.office365.com has unexpected certificates under trusted authority: <DigiCert> with thumbprint: A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436. Mismatch of pin rules for domain: .office365.com with effective date: ‎Freitag, ‎14. ‎Oktober ‎2016 17:55:07 and sequence number: 01D2263355B57CAZ. Certificates saved to: <C:\Users\tabsi\AppData\LocalLow\Microsoft\MismatchPinRuleCerts\EXCEL.EXE_outlook.office365.com.p7b>.   147 90.184049
Server: outlook.office365.com has unexpected certificates under trusted authority: <DigiCert> with thumbprint: A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436. Mismatch of pin rules for domain: .office365.com with effective date: ‎Freitag, ‎14. ‎Oktober ‎2016 17:55:07 and sequence number: 01D2263355B57CAZ. Certificates saved to: <C:\Users\tabsi\AppData\LocalLow\Microsoft\MismatchPinRuleCerts\svchost.exe_outlook.office365.com.p7b>. 7   4.294479
Server: autodiscover-s.outlook.com has unexpected certificates under trusted authority: <DigiCert> with thumbprint: A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436. Mismatch of pin rules for domain: .outlook.com with effective date: ‎Freitag, ‎14. ‎Oktober ‎2016 17:55:07 and sequence number: 01D2263355B57CAZ. Certificates saved to: <C:\Users\tabsi\AppData\LocalLow\Microsoft\MismatchPinRuleCerts\EXCEL.EXE_autodiscover-s.outlook.com.p7b>.   7   4.294479
Server: outlook.office365.com has unexpected certificates under trusted authority: <DigiCert> with thumbprint: A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436. Mismatch of pin rules for domain: .office365.com with effective date: ‎Freitag, ‎14. ‎Oktober ‎2016 17:55:07 and sequence number: 01D2263355B57CAZ. Certificates saved to: <C:\Users\tabsi\AppData\LocalLow\Microsoft\MismatchPinRuleCerts\OUTLOOK.EXE_outlook.office365.com.p7b>. 1   0.613497
Server: autodiscover-s.outlook.com has unexpected certificates under trusted authority: <DigiCert> with thumbprint: A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436. Mismatch of pin rules for domain: .outlook.com with effective date: ‎Freitag, ‎14. ‎Oktober ‎2016 17:55:07 and sequence number: 01D2263355B57CAZ. Certificates saved to: <C:\Users\tabsi\AppData\LocalLow\Microsoft\MismatchPinRuleCerts\OUTLOOK.EXE_autodiscover-s.outlook.com.p7b>. 1   0.613497

Answer 1

Such error would occur if your organization have implemented Enterprise Certificate Pinning and the certificate with thumbprint A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 has not been included in your certificate list.

You may check or reconfigure the enterprise certificate pinning policy to include this certificate or its root certificate.

For your reference: https://docs.microsoft.com/en-us/windows/access-protection/enterprise-certificate-pinning