This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(163.2, 19%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EI%3C/text%3E%3C/svg%3E)
Two-way trust is established between the two domains, and have been added the TXT DNS
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 67%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJS%3C/text%3E%3C/svg%3E)
Hi @ITSUPPORT
Take a reference at the methods discussed in this similar thread: Exchange Server Federation Error
Make sure TLS1.2 is enabled for your on-prem server, detailed steps here: Enabling TLS 1.2 and Identifying Clients Not Using It
And more information about sharing in on-prem Exchange server, which applied to Exchange 2016 as well: https://learn.microsoft.com/en-us/exchange/sharing-exchange-2013-help?source=recommendations
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi joyceshen-MSFT ,
Thank you for your answer, I followed the steps to added the registry on my Exchange server and restarted the machine, But the same error is reported. Do you have any other idea ? Looking forward to your reply, thank you very much!
Hi,
Thanks for your feedback, have you checked if the machine/system account can access the Microsoft Federation Gateway URL:
https://domains.live.com/service/managedelegation2.asmx [<– You should see the operations supported by ManageDelegation2.]
Note: If the Exchange requires a proxy server to access the Internet, specify the proxy server using “Set-ExchangeServer myExchange01 -InternetWebProxy http://myproxy:80”. Notice such proxy can’t require any user authentication for outbound Internet access, and the proxy must start with HTTP: and not HTTPS: (secure SSL).
You can also set the proxy using netsh as well.
set proxy proxy-server=”http=myproxy;https=sproxy:88″ bypass-list=”*.contoso.com”
In rare instances, you can use the machine/system account to access the URLs from the browser, but Exchange cmdlets still failed with "Could not establish trust relationship for the SSL/TLS secure channel." If that happens, make sure the certificate authorities for the urls are installed at the Third-Party Root Certification Authorities of the machine local certificate location.
In addition, you must allow outbound HTTPS access (port 443 for TCP) from all Exchange in the organization.
Hi joyceshen-MSFT,
As the screen shot indicates, My machine can access to the Microsoft Federation Gateway URL and this error is reported anyway. so how can I get the certificate authorities for the urls ? thank you very much.
Hi,
Could you please check if the certificate you are using in federation trust meet the requirement introduced here: Trusted root certification authorities for federation trusts
And for the certificate storage, you could use MMC tool to add the certificate snap-in:
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi,
Is there any progress about this issue so far?