SharePoint 2013 Secure store service Error - Sorry this site hasn't been shared with you

Alessandro Piras 96

Hi all,

i just performed a clean install of SharePoint server 2013 (SP1) on a server.
the farm consists of only one server.
After installing SharePoint and all service applications:
• Excel Service
• Performance Point Service
• SQL Server Reporting Services Service Application
• Secure Store Service Application
I encountered a problem on the Secure Store service:
when I open the service application I get "Sorry this site hasn't been shared with you".

in the event viewer log i see:
"The Secure Store Service application Secure Store Service is not accessible. The full exception text is: Could not establish trust relationship for the SSL / TLS secure channel with authority 'servername: 32844'"

I tried to:

re-import the SharePoint root certificate into manage trust
I have checked and there are no associated certificates in the "SharePoint web services" site

The secure store service application is running.
what can i do? I don't understand where the problem is.

THANK YOU!!

Accepted answer

Alessandro Piras 96 Reputation points

2021-06-30T11:08:57.457+00:00

Hi Echo Du,

I deleted and recreated the service application but the result is always the same.
However, I found the solution to the problem.
the problem was not related to permissions or certificates but to the TLS settings that the customer applied on the machines.
As I showed you earlier, the TLS and Ciphers settings had been customized.
To fix the problem I had to enable strong cryptography in .NET Framework 4.6. adding the following registry keys:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001

https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/enable-tls-and-ssl-support-in-sharepoint-2013#16---enable-strong-cryptography-in-net-framework-46-or-higher

After this I was able to successfully open the Secure StoreService page.

Thank you very much!!
Please sign in to rate this answer.
Echo Du_MSFT 17,141 Reputation points

2021-07-01T01:18:29.27+00:00

Hi @Alessandro Piras ,

I'm glad to hear that your problem has been solved.

You can mark your answer. The behavior will help others who meet the similar issue in the future quickly find the correct answer.

Have a nice day!

Thanks,
Echo Du
Sign in to comment

1 additional answer

Echo Du_MSFT 17,141 Reputation points

2021-06-18T02:38:35.23+00:00
Hello @Alessandro Piras ,

Welcome to Q&A Forum!

Per my understanding, the reason is some permissions and GPO issues when we installed SharePoint. That the server was too locked down and the installer was unable to import the root certificate.

For resolving your issue, you need to add the SSL to the SharePoint Trusted Root Authority. You are able to do as the followings:

1.Export a SSL Certificate from Windows Server.

2.Add the SSL Certificate into SharePoint Trusted Root Certificate authority.

3.Open IIS >> Application Pools >> SecurityTokenServiceApplicationPool >> right click >> Advanced Settings >> make sure the Identity is a farm account

4.Reset IIS: Open Windows PowerShell as an admin >> enter iisreset

Here is an article about exporting a SSL Certificate and adding it into SharePoint Trusted Root Certificate authority.

Below is a similar post for your reference:

Secure Store Service stops working once or twice every day, Could not establish trust relationship for the SSL/TLS secure channel with authority 'servername:32844'.

Thanks,
Echo Du

==============================

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Alessandro Piras 96 Reputation points

2021-06-18T07:14:57.903+00:00

Hi Echo Du,
thank you so much for your answer! which certificate should I export from the server and import to SharePoint?
I performed several actions:

I exported the SharePoint Root certificate like this:

$rootCert = (Get-SPCertificateAuthority).RootCertificate
$rootCert.Export(“Cert”) | Set-Content d:\SharepointRoot.cer -Encoding byte

and then re-imported it to manage trust within SharePoint.

I imported my web application certificate into SharePoint.

IIS resets and server restarts have been performed

at the moment, all these actions have not helped to solve the problem.
is there anything else i can check?

Thank you!!

Echo Du_MSFT 17,141 Reputation points

2021-06-18T10:25:35.037+00:00

Hi @Alessandro Piras ,

Please following steps:

1.Run the below script as an admin to export the SSL certificate

$rootCert = (Get-SPCertificateAuthority).RootCertificate $rootCert.Export(“Cert”) | Set-Content C:\SharepointRoot.cer -Encoding byte

2.Then start-up MMC(Microsoft Management Console), connect to local computer.

3.Browse to "Trusted Root Certification Authorities / Certificates" to import the SSL certificate.

4.Restart IIS >> iisreset

Thanks,
Echo Du

Alessandro Piras 96 Reputation points

2021-06-18T10:41:40.777+00:00

Hi!
Thank you so much for your answer.

yes, I have already performed this activity and subsequently I have performed IIS reset and restart of the Server.
the SharePoint root certificate is present within the SharePoint Central Administration and is also present on Trusted Root Certification Authorities / Certificates.

I have compared the thumbprints and they are the same.
is there anything else i can do?

thanks !!

Echo Du_MSFT 17,141 Reputation points

2021-06-18T10:57:07.677+00:00

Hi @Alessandro Piras ,

I found a related article about this error, but this article uses powershell to unbind the certificate.

Secure Store Service This Site hasn´t been shared with you SP 2013

Thanks,
Echo Du

Alessandro Piras 96 Reputation points

2021-06-18T12:11:11.783+00:00

Hi Echo Du
Yes.
I checked the "SharePoint web services" site and it has no certificate (as it should be).
anyway, I still ran the powershell command that is described in the article and restarted the services and IIS.
nothing has changed;
the problem is still present.

thank you for any other help you can give me.

Alessandro

Echo Du_MSFT 17,141 Reputation points

2021-06-21T08:43:47.29+00:00

Hi @Alessandro Piras ,

Thanks for your reply.

Please perform the following troubleshooting:

1.Check whether the "SecurityTokenServiceApplicationPool" application pool is started

2.View ULS logs in SharePoint 2013

Thanks,
Echo Du

Alessandro Piras 96 Reputation points

2021-06-21T08:48:43.23+00:00

Hi Echo Du,

the SecurityTokenServiceApplicationPool is correctly started with admin account.
The ULS log reported me:

The Secure Store Service application Secure Store Service is not accessible. The full exception text is: Could not establish secure channel for SSL/TLS with authority 'swperws02c:32844'.
Unexpected exception from endpoint address : https://swperws02c:32844/c102bd717e9b4f8b92e0bdbb119cf4d1/SecureStoreService.svc/https

Logging unknown/unexpected client side exception: SecurityNegotiationException. This will cause this application server to be removed from the load balancer queue. Exception: System.ServiceModel.Security.SecurityNegotiationException: Could not establish secure channel for SSL/TLS with authority 'swperws02c:32844'. ---> System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.

Alessandro Piras 96 Reputation points

2021-06-21T08:49:26.763+00:00

Error occured while managing Secure Store Application ebcb6942-2798-4c3c-b345-ed752e58172a. Error message: Secure Store Service did not performed the operation..

Access Denied. Exception: Attempted to perform an unauthorized operation., StackTrace:
at Microsoft.Office.SharePoint.ClientExtensions.SecureStoreAdministration.ManageSSSvcApplication.InitializeGridView()
at Microsoft.Office.SharePoint.ClientExtensions.SecureStoreAdministration.ManageSSSvcApplication.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()

Echo Du_MSFT 17,141 Reputation points

2021-06-21T09:23:49.197+00:00

Hi @Alessandro Piras ,

Have you enabled TLS 1.1 and 1.2 in SharePoint 2013? Please following "Enable TLS and SSL support in SharePoint 2013" article to check.

If this issue still exists, it is recommended that you can reconfigure the Secure Store Service Application. There a blog about configuring Secure Store Service Application for your reference.

Thanks,
Echo Du

Echo Du_MSFT 17,141 Reputation points

2021-06-23T10:44:00.833+00:00

Hi @Alessandro Piras ,

Is there anything else I can help with regarding this issue?

You can comment us at any time and we will continue to follow up.

Thanks,
Echo Du

Alessandro Piras 96 Reputation points

2021-06-25T13:24:54.85+00:00

Echo Du

i have checked the configuration of TLS.
Below are the configurations present on the servers (applied by the customer) and already present at the time of SharePoint installation:

SERVER SHAREPOINT

Thank you!

Alessandro Piras 96 Reputation points

2021-06-25T13:25:48.743+00:00

SERVER SQL

Thank you!

Echo Du_MSFT 17,141 Reputation points

2021-06-28T01:43:33.28+00:00

Hi @Alessandro Piras ,

Thanks for your reply.

Will there be a problem if you delete the Secure Store Service Application and recreate it?

Thanks,
Echo Du

Echo Du_MSFT 17,141 Reputation points

2021-06-30T07:07:17.36+00:00

Hi @Alessandro Piras ,

Would you tell me whether your issue has been resolved or have any update?
I am looking forward to your reply.

Have a nice day!

Thanks,
Echo Du
Sign in to comment

Share via

SharePoint 2013 Secure store service Error - Sorry this site hasn't been shared with you

1 additional answer