Windows Server 2008 R2 w/ IIS 7.5 w/ Autodiscover.xml, but SAN-Certificate causes "Target Principle name is incorrect"

Outlook 365 finds the account through autodiscover without any problems, but warns about "Target Principle name is incorrect" (CN=eposthub.de), when adding an account like [email protected]

As I understand, the newest Outlook versions supports SAN-Certificates (alternate domain names).

My setup contains:

1. Windows Server 2008 R2 w/ IIS 7.5
2. hMailServer (IMAP, SMTP)

3. SSL-SAN-Certificate

   1. CN=eposthub.de.
   2. DNS-Name=smtp.nabil-redmann.de
   3. DNS-Name=imap.nabil-redmann.de
   4. DNS-Name=autodiscover.nabil-redmann.de

4. https://autodiscover.nabil-redmann.de/autodiscover/autodiscover.xml

   • generated XML-content
   • GIST: aspx source + web.config

My ideas to a solution:

Q1: What can I do, to make the alternating domain names to be looked up (without having to touch the client system)?

Q1.2: ... with touching the client system?

Q2: Is there an Autodiscover.xml tag to make it accept a principal name?

Q3: What else did I miss?

from testconnectivity.microsoft.com, only 1 warning:

Analyzing the certificate chains for compatibility problems with versions of Windows.
Potential compatibility problems were identified with some versions of Windows.

Additional Details

The Microsoft Connectivity Analyzer can only validate the certificate chain using the 
Root Certificate Update functionality from Windows Update. Your certificate may not 
be trusted on Windows if the "Update Root Certificates" feature isn't enabled.

what does that mean?