The quick, easy fix for this works like:
1. If you're not using a trusted 3rd party ssl certificate download (from Zentyal Webmin Mail>Openchange>Download Cert) and install it as a "Trusted Root CA", DO NOT AUTOMATICALLY INSTALL IT B/C THAT DOESN"T WORK, pick the TRUSTED ROOT CONTAINER!!!!!
2. Wherever your external DNS is being handled it's likely they didn't create a DNS record for it so create a subdomain "Autodiscover.yourdomain.com" - please pay close attention to "Autodiscover" and not "autodiscover" because if it's not cap it don't work.
3. Point that subdomain "Autodiscover.yourdomain.com" at "
https://yourdomain.com:443/autodiscover/autodiscover.xml"
NO, that's not a typo, it's the file "autodiscover.xml" inside the directory "autodiscover" and yes, they are both lower case, the caps part only counts in the sub domain.
Once everything is all propagated through the DNS you should have a properly working and fully functional autodiscover.
You may need to tweak things, like obviously changing "yourdomain.com" to whatever the actual domain is. In addition I have some instances where Zentyal is solely an email server and the web server resides on a completely different IP/Subnet/etc. in which case the HTTP redirect for the subdomain points back to the FQDN "
https://hostname.yourdomain.com:443/autodiscover/autodiscover.xml" since the actual domain name points to a completely different server.
If you're not using trusted 3rd party SSL certificates and you have not installed the root certificate from Zentyal Mail>Openchange as a trusted root certificate then you will NEVER, ever, never be able to connect vial autodiscover in Outlook. It doesn't matter what you do, or how you tweak something unless you're inside the LAN you will not be able to connect.
To the dumb a** that's going to try and be smart popping off with VPN, why on God's Green Earth would you even consider having that much overhead for people to be able to send/receive email when they can just install the cert? No, VPN is not the solution to that problem and no, VPN is not a very good idea for so many other reasons.
Anyways this should get you of the ground and working with 2016 and for the record it's still there it's just hidden better for the manual config side of things. They're just trying to scare everyone into going Exchange since they killed SBS hundreds and maybe thousands have migrated to Zentyal, ClearOS and Netserver as alternatives. Basically MS knocked themselves out of cornering the market LoL.