Hi Niels,
Based on the error message, as your assumption, the issue should be caused by the Autodiscover service failing with the custom domains.
As for your concerns, based on my experience, we can use some other methods to avoid adding multiple names to the current certificate on the Hybrid server, such as using HTTP redirect methods.
To find a workaround, I would like to collect the following detailed information:
1. What’s your Exchange server 2010 version, such as 14.03.0174.001? You can open EMC > Help> About Exchange server 2010… to check it.
2. You mentioned “However, when running this from the powershell, it works fine for both .com and .nl, albeit warning about "http://autodiscover.contoso.com/autodiscover being insecurely redirected to https://office.contoso.com/autodiscover".”.
Could you please provide more detailed information about it, such as the outputs of the PowerShell?
3. Please run an Autodiscover ExRCA test for the secondary custom domain (here is contoso.nl) and provide all of the test results (expand the sub-options) whatever the test passes or fails.
Thanks,
Claud