Windows integrated CA - Certificates are not usable for any browser NET::ERR_CERT_INVALID

The error appears while Chrome connects to localhost, so first check whether the certificate covers localhost or the Exchange name clients should use. A trusted root alone is insufficient: the served certificate must be valid, chain to a trusted CA, include Server Authentication, match the requested DNS name, have a private key, and be bound to HTTPS. Open the browser certificate details and record the subject, SANs, issuer, thumbprint, and exact error. Test with the Exchange FQDN instead of localhost. On the server, run certutil -verify -urlfetch against an exported certificate and netsh http show sslcert; compare the thumbprint with the IIS binding. For Exchange, confirm the certificate is assigned to IIS using Get-ExchangeCertificate, and enable the intended certificate for IIS if required. If the SAN lacks mail, autodiscover, or the tested FQDN, issue a new Web Server certificate with those names rather than bypassing the warning.