This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(131.20000000000002, 12%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMM%3C/text%3E%3C/svg%3E)
Hi,
After installing the update KB5004780 OWA and ECP doesn't work anymore.
The error in the eventviewer doesn't give me enough information.
I can't find anything useful online about the error message.
Anyone else out there with something similar or a better solution?
Kind regards,
Marc
Process information:
Process ID: 2064
Process name: w3wp.exe
Account name: NT AUTHORITY\SYSTEM
Exception information:
Exception type: ExAssertException
Exception message: ASSERT: HMACProvider.GetCertificates:protectionCertificates.Length<1
at Microsoft.Exchange.Diagnostics.ExAssert.AssertInternal(String formatString, Object[] parameters)
at Microsoft.Exchange.Diagnostics.ExAssert.RetailAssert[T1,T2](Boolean condition, String formatString, T1 parameter1, T2 parameter2)
at Microsoft.Exchange.Clients.Common.HmacProvider.GetCertificates()
at Microsoft.Exchange.Clients.Common.HmacProvider.GetHmacProvider()
at Microsoft.Exchange.Clients.Common.HmacProvider.ComputeHmac(Byte[][] messageArrays)
at Microsoft.Exchange.HttpProxy.FbaModule.SetCadataCookies(HttpApplication httpApplication)
at Microsoft.Exchange.HttpProxy.FbaFormPostProxyRequestHandler.HandleFbaFormPost(BackEndServer backEndServer)
at Microsoft.Exchange.HttpProxy.FbaFormPostProxyRequestHandler.ShouldContinueProxy()
at Microsoft.Exchange.HttpProxy.ProxyRequestHandler.BeginProxyRequestOrRecalculate()
at Microsoft.Exchange.HttpProxy.ProxyRequestHandler.InternalOnCalculateTargetBackEndCompleted(TargetCalculationCallbackBeacon beacon)
at Microsoft.Exchange.HttpProxy.ProxyRequestHandler.<>c__DisplayClass280_0.<OnCalculateTargetBackEndCompleted>b__0()
at Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action tryDelegate, Func2 filterDelegate, Action1 catchDelegate)
at Microsoft.Exchange.HttpProxy.ProxyRequestHandler.CallThreadEntranceMethod(Action method)
Hi @Yuki Sun-MSFT ,
Thanks for your response, I've already tried that but with no luck.
Maybe I didn't wait long enough. I will try again.
For now uninstalling the patch did the job; but that is not a real solution. But ECP and OWA works again.
Thanks for the link; I will follow that thread to.
Many people suffer from it. This is also an interesting link
https://techcommunity.microsoft.com/t5/exchange-team-blog/released-july-2021-exchange-server-security-updates/bc-p/2548895/highlight/true#M30832
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 94%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEG%3C/text%3E%3C/svg%3E)
You have to wait longer than an hour. It took at least 2-3 hours for my update to go through.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EYS%3C/text%3E%3C/svg%3E)
Hi @Marc Meul ,
Thanks for the feedback. Agree with you that normally it's not recommended to uninstall a security patch, so personally I'd recommend trying to install the update back in non-working hours, then re-publish the Oauth certificate and wait for a few more hours and check the result(1~4 hours according to the feedback we've seen so far.).
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
@Yuki Sun-MSFT that's what I am going todo indeed; install in non-working hours, and then wait for a long time.
Thank you for the answers.
Hopefully this time it can succeed. And should there's any update or further questions on this, feel free to post back.
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi @Marc Meul ,
It has been a few days and I'd like to follow up to see how things are going on with this thread. Have you had a chance to try installing the update again and does everything go well?
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
hi @Yuki Sun-MSFT ,
I've installed the update last Saturday with no problems; Just used windows update to install and everything works all fine.
So, or I was lucky or they changed the update.
Hi @Marc Meul ,
Great! Glad to know that it went well : )
Hi @Marc Meul ，
Please follow the steps in the article below to re-publish the Oauth certificate, then wait for a few hours for the change to take place:
Can't sign in to Outlook on the web or EAC if Exchange Server OAuth certificate is expired
Here's a similar case for reference: Exchange Server error in '/owa' application.
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
For anyone else reading this: "Up to an hour isn't true". This can take much much longer if you have multiple domains.
In my case it took over 2 hours.
Thanks @Emil Gustafsson for pointed this out. I'll edit my post earlier in case it causes confusion for others.
I think this might be do me having like 10 SMTP domains in my environment? Might be a good idea to edit the KB post if such so people with less cool minds, such as myself, don't panic after 3600 seconds ;-)
I suggested a change for the page that they adjust wait time to longer
https://learn.microsoft.com/en-us/exchange/troubleshoot/administration/cannot-access-owa-or-ecp-if-oauth-expired#resolution
https://github.com/MicrosoftDocs/OfficeDocs-Support/issues/1688
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(70.4, 15%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAB%3C/text%3E%3C/svg%3E)
Hi @Yuki Sun-MSFT
I was trying to install security update to Exchange server 2016 cu20 this night. The same error occured after installation complete. When i try to apply above article power shell gives a syntax error on second step, so the fix doesnt work. Could you help me?
Set-AuthConfig -NewCertificateThumbprint <ThumbprintFromStep1> -NewCertificateEffectiveDate (Get-Date)
The '<' operator is reserved for future use ...
Hi @Asiye Bayrak ,
Set-AuthConfig -NewCertificateThumbprint <ThumbprintFromStep1> -NewCertificateEffectiveDate (Get-Date)
The '<' operator is reserved for future use ...
Please replace "<ThumbprintFromStep1>" with the thumbprint of the new certificate created in Step1.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(316.8, 22%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEG%3C/text%3E%3C/svg%3E)
The fix suggested is definitely working. Please be patient grab a coffee and check back later. I had to give it 3 hours for it to work.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(297.6, 68%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAA%3C/text%3E%3C/svg%3E)
Works for me too.
Take 2h and a half for me (i have no more hairs...)
Worked for me too and take 2 hours and half