Issue: Exchange 2010 SP3 R15 - Setting up External Autodiscover to support federated sharing - Gettng Event ID 3: WebHost failed to process a request.

I'm in the middle of trying to get Autodiscover working to support Federated sharing and ran into an issue.

First let me lay out the system.

We are using redirect and TMG.

Request goes to autodiscover.maildomain.com\autodiscover\autodiscover.xml

redirect sends it to https:\domainname.com\autodiscover\autodiscover.xml

TMG proxies it from 443 to 8443

8443 is bound to a 2nd IIS Site on the exchange server we will call "External"

In exchange we ran new-autodiscovervirtualdirectory with basic and windows auth set to $true publishing autodiscover to the "External" IIS site.

So at this point the redirect works, TMG is proxying correctly but when I run the exchange connectivity analyzer it fails when trying to post

Attempting to send an Autodiscover POST request to potential Autodiscover URLs.

and

The Microsoft Connectivity Analyzer is attempting to retrieve an XML Autodiscover response from URL https://domainname.com/autodiscover/autodiscover.xml for user polar_ted@maildomain.com The Microsoft Connectivity Analyzer failed to obtain an Autodiscover XML response.

Additional Details

An HTTP 500 response was returned from Unknown.

in the event logs I see an Event ID 3 from webhost

WebHost failed to process a request. Sender Information: System.ServiceModel.ServiceHostingEnvironment+HostingManager/50632145 Exception: System.ServiceModel.ServiceActivationException: The service '/Autodiscover/Autodiscover.xml' cannot be activated due to an exception during compilation. The exception message is: Could not find a base address that matches scheme http for the endpoint with binding CustomBinding. Registered base address schemes are [https].. ---> System.InvalidOperationException: Could not find a base address that matches scheme http for the endpoint with binding CustomBinding. Registered base address schemes are [https].

In IIS the only binding on "External" site is type HTTPS - 8443 to *

So uhh any help?