If you didn't enable a wildcard certificate on the Domain Scope page, on the %BRAND_EXCHANGE_ONLINE_SHORT% Configuration ...