Do the following:
1. Collect the Secure Mail application logs.
2. If you see the following message in the client logs, set clientCertificateMappingAuth to enabled in IIS on the Exchange Server. For more information, refer to the FAQ section of the Secure Mail Test Application.
[AUTH] Request <ASIHTTPRequest: 0x16cb0e00> received 401 challenge and must authenticate
Received errorDomain=ASIHTTPRequestErrorDomain and errorCode=3
Failed with authentication error
ProvisionStatusAutoDiscoverFailedAuthError or ProvisionStatusProvisionFailedAuthError authentication error
3. In the client logs, if you see the following messages, ensure that the Exchange Server FQDN is valid and is reachable.
Successfully retrieved client certificate
Received error that was determined to NOT to be an SSL error with errorDomain=kCFErrorDomainCFNetwork, errorCode=2, description=Error Domain=kCFErrorDomainCFNetwork Code=2 The operation couldn’t be completed.(kCFErrorDomainCFNetwork error 2.)" UserInfo=0x17eee320 {kCFGetAddrInfoFailureKey=8} ProvisionStatusFailedGeneric - provision failed due to a reason highlighted higher in the logs
Additional Resources:
Full XenMobile Deployment Handbook
Other Troubleshooting Checklist Articles: