Ive been working through the weekend to complete my Exchange 2013/2007 coexistence upgrade. I first upgraded 2007 to CU13.  I installed exchange 2013 CU9. I main problem at this time is active sync/autodiscover. I have not moved any 2007useres to 2013. 2007 users can successful send and receive mail via Outlook client and OWA. However, mobile devices do not connect. A work around is to change settings to legacy.domain.com instead of mail.domain.com. using remote connectivity analyser I get the following:

Attempting the Autodiscover and Exchange ActiveSync test (if requested).
 Testing of Autodiscover for Exchange ActiveSync failed.
 
Test Steps
 
Attempting each method of contacting the Autodiscover service.
 The Autodiscover service couldn't be contacted successfully by any method.

Test Steps
 
Attempting to test potential Autodiscover URL https://domain.com:443/Autodiscover/Autodiscover.xml
 Testing of this potential Autodiscover URL failed.
 
Test Steps
 
Attempting to resolve the host name domain.com in DNS.
 The host name resolved successfully.

Testing TCP port 443 on host domain.com to ensure it's listening and open.
 The specified port is either blocked, not listening, or not producing the expected response.
  Tell me more about this issue and how to resolve it
 
 A network error occurred while communicating with the remote host.

Attempting to test potential Autodiscover URL https://autodiscover.domain.com:443/Autodiscover/Autodiscover.xml
 Testing of this potential Autodiscover URL failed.
 
Test Steps
 
Attempting to resolve the host name autodiscover.domain.com in DNS.
 The host name resolved successfully.
 
Additional Details
 
IP addresses returned: X.X.X.X

Testing TCP port 443 on host autodiscover.domain.com to ensure it's listening and open.
 The port was opened successfully.

Testing the SSL certificate to make sure it's valid.
 The certificate passed all validation requirements.
 
Test Steps
 
The Microsoft Connectivity Analyzer is attempting to obtain the SSL certificate from remote server autodiscover.domain.com on port 443.
 The Microsoft Connectivity Analyzer successfully obtained the remote SSL certificate.
 
Additional Details
 
Remote Certificate Subject: CN=mail.domain.com, OU=Domain Control Validated, Issuer: CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US.

Validating the certificate name.
 The certificate name was validated successfully.
 
Additional Details
 
Host name autodiscover.domain.com was found in the Certificate Subject Alternative Name entry.

Certificate trust is being validated.
 The certificate is trusted and all certificates are present in the chain.
 
Test Steps
 
The Microsoft Connectivity Analyzer is attempting to build certificate chains for certificate CN=mail.domain.com, OU=Domain Control Validated.
 One or more certificate chains were constructed successfully.
 
Additional Details
 
A total of 2 chains were built. The highest quality chain ends in root certificate OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US.

Analyzing the certificate chains for compatibility problems with versions of Windows.
 Potential compatibility problems were identified with some versions of Windows.
 
Additional Details
 
The Microsoft Connectivity Analyzer can only validate the certificate chain using the Root Certificate Update functionality from Windows Update. Your certificate may not be trusted on Windows if the "Update Root Certificates" feature isn't enabled.

Testing the certificate date to confirm the certificate is valid.
 Date validation passed. The certificate hasn't expired.
 
Additional Details
 
The certificate is valid. NotBefore = 8/7/2015 10:37:38 PM, NotAfter = 3/10/2016 4:32:00 AM

Checking the IIS configuration for client certificate authentication.
 Client certificate authentication wasn't detected.
 
Additional Details
 
Accept/Require Client Certificates isn't configured.

Attempting to send an Autodiscover POST request to potential Autodiscover URLs.
 Autodiscover settings weren't obtained when the Autodiscover POST request was sent.
 
Additional Details
 
Test Steps
 
The Microsoft Connectivity Analyzer is attempting to retrieve an XML Autodiscover response from URL https://autodiscover.domain.com:443/Autodiscover/Autodiscover.xml for user me@domain.com.
 The Microsoft Connectivity Analyzer failed to obtain an Autodiscover XML response.
 
Additional Details
 
An HTTP 500 response was returned from Unknown.
HTTP Response Headers:
request-id: f3644d3b-613e-43a1-b835-7191377d4891
X-CalculatedBETarget: exch2013.domain.com
X-DiagInfo: EXCH2013
X-BEServer: EXCH2013
Cache-Control: private
Content-Type: text/html; charset=utf-8
Set-Cookie: ClientId=FJVIVFPIURWYLXXJSUW; expires=Tue, 09-Aug-2016 13:39:49 GMT; path=/; HttpOnly,X-BackEndCookie=S-1-5-21-3970167411-3836497950-71674325-1164=u56Lnp2ejJqBx5zLyZ2encjSz8+aytLLxsqZ0p2byMzSyZueyM/Jy8nNzcmagYHNz87K0s/G0s/Gq87MxczGxcvG; expires=Wed, 09-Sep-2015 13:39:49 GMT; path=/Autodiscover; secure; HttpOnly
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
Persistent-Auth: true
X-Powered-By: ASP.NET
X-FEServer: EXCH2013
Date: Mon, 10 Aug 2015 13:39:49 GMT
Content-Length: 7062

Attempting to contact the Autodiscover service using the HTTP redirect method.
 The attempt to contact Autodiscover using the HTTP Redirect method failed.
 
Additional Details
 
Test Steps
 
Attempting to resolve the host name autodiscover.domain.com in DNS.
 The host name resolved successfully.
 
Additional Details
 
IP addresses returned: X.X.X.X

Testing TCP port 80 on host autodiscover.domain.com to ensure it's listening and open.
 The port was opened successfully.

The Microsoft Connectivity Analyzer is checking the host autodiscover.domain.com for an HTTP redirect to the Autodiscover service.
 The Microsoft Connectivity Analyzer failed to get an HTTP redirect response for Autodiscover.
 
Additional Details
 
An HTTP 401 Unauthorized response was received from the remote Unknown server. This is usually the result of an incorrect username or password. If you are attempting to log onto an Office 365 service, ensure you are using your full User Principal Name (UPN).
HTTP Response Headers:
request-id: 486dbd86-1b4a-484a-9921-c28f76103ca1
X-SOAP-Enabled: True
X-WSSecurity-Enabled: True
X-WSSecurity-For: None
X-OAuth-Enabled: True
Cache-Control: private
Set-Cookie: ClientId=GOMHIENKWTVLUOMSFDG; expires=Tue, 09-Aug-2016 13:39:49 GMT; path=/; HttpOnly
Server: Microsoft-IIS/8.5
WWW-Authenticate: Negotiate,NTLM,Basic realm="autodiscover.domain.com"
X-Powered-By: ASP.NET
X-FEServer: EXCH2013
Date: Mon, 10 Aug 2015 13:39:49 GMT
Content-Length: 0

Attempting to contact the Autodiscover service using the DNS SRV redirect method.
 The Microsoft Connectivity Analyzer failed to contact the Autodiscover service using the DNS SRV redirect method.
 
Test Steps
 
Attempting to locate SRV record _autodiscover._tcp.domain.com in DNS.
 The Autodiscover SRV record wasn't found in DNS.
  Tell me more about this issue and how to resolve it
 
Additional Details
 
Checking if there is an autodiscover CNAME record in DNS for your domain 'domain.com' for Office 365.
 Failed to validate autodiscover CNAME record in DNS. If your mailbox isn't in Office 365, you can ignore this warning.
  Tell me more about this issue and how to resolve it
 
Additional Details
 
There is no Autodiscover CNAME record for your domain 'domain.com'.

One thing to check is that the self-signed certificate is bound to the IIS Exchange Back End website.

I opened a ticket with Microsoft:

Problem: OWA fails when new 2013 user accounts attempt to log on

Fix 1: %systemroot%\Program Files\Microsoft\Exchange Server\V15\ClientAccess\SharedWebConfig.config was missing.  The tech created an empty file and copied the contents from the same file from his lab environment

Fix 2: In IIS on the 2013 server, he removed the HTTP Redirect from the Exchange Back End site

Problem: both 2007 users and 2013 users cannot get email on their mobile devices due to autodiscover and active-sync issues

Fix:

• With Fix 1 and 2 being already applied, ExRCA now only produced a 403 error on Active-Sync.In
• IIS on Exchange 2013 server, the 2 binding for 127.0.0.1 were missing.  One for port 80 and the other for port 443. Be sure to apply the 3rd party certificate for mail.mydomain.com to 443
• On 2007 Exchange CAS server, in Exchange Management Console, removed the external URL from Microsoft-Server-ActiveSync found in Server Configuration - Client Access - Exchange ActiveSync
• On 2007 Exchange CAS Server Enabled Windows Authentication on Active Sync via:

Get-ActiveSyncVirtualDirectory -Server exchcas01 | Set-ActiveSyncVirtualDirectory -WindowsAuthEnabled $true

• Marked as answer by bassoml 19 hours 9 minutes ago