OWA and ECP doesn't work after update KB5004780

Question

Hi,

After installing the update KB5004780 OWA and ECP doesn't work anymore.

The error in the eventviewer doesn't give me enough information.
I can't find anything useful online about the error message.

Anyone else out there with something similar or a better solution?

Kind regards,
Marc

Process information:
Process ID: 2064
Process name: w3wp.exe
Account name: NT AUTHORITY\SYSTEM

Exception information:
Exception type: ExAssertException
Exception message: ASSERT: HMACProvider.GetCertificates:protectionCertificates.Length<1
at Microsoft.Exchange.Diagnostics.ExAssert.AssertInternal(String formatString, Object[] parameters)
at Microsoft.Exchange.Diagnostics.ExAssert.RetailAssert[T1,T2](Boolean condition, String formatString, T1 parameter1, T2 parameter2)
at Microsoft.Exchange.Clients.Common.HmacProvider.GetCertificates()
at Microsoft.Exchange.Clients.Common.HmacProvider.GetHmacProvider()
at Microsoft.Exchange.Clients.Common.HmacProvider.ComputeHmac(Byte[][] messageArrays)
at Microsoft.Exchange.HttpProxy.FbaModule.SetCadataCookies(HttpApplication httpApplication)
at Microsoft.Exchange.HttpProxy.FbaFormPostProxyRequestHandler.HandleFbaFormPost(BackEndServer backEndServer)
at Microsoft.Exchange.HttpProxy.FbaFormPostProxyRequestHandler.ShouldContinueProxy()
at Microsoft.Exchange.HttpProxy.ProxyRequestHandler.BeginProxyRequestOrRecalculate()
at Microsoft.Exchange.HttpProxy.ProxyRequestHandler.InternalOnCalculateTargetBackEndCompleted(TargetCalculationCallbackBeacon beacon)
at Microsoft.Exchange.HttpProxy.ProxyRequestHandler.<>c__DisplayClass280_0.<OnCalculateTargetBackEndCompleted>b__0()
at Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action tryDelegate, Func2 filterDelegate, Action1 catchDelegate)
at Microsoft.Exchange.HttpProxy.ProxyRequestHandler.CallThreadEntranceMethod(Action method)

Answer 1

Any impact to mail flow when recreating this certificate?

is it necessary to run the Hybrid Configuration Wizard afterwards for hybrid configurations?

Answer 2

Took an hour and 20mins to publish then worked fine. Its a long time to find out if a fix is going to work but thankfully it did. Be patient!

Answer 3

I come from the same problem. I had guessed the cause, then I checked with Microsoft Support. The problem occurs if the certificate has expired and you can do the restore operation.
But it also occurs with the valid certificate. In fact, it is due to the incompatibility of OWA and ECP cookies between updated and non-updated servers.

The solution is to have only updated servers or outdated servers communicate in the CAS balance. So, either you update a couple of servers and then you swith all the traffic to these only ones updated, or, you have to set the affinity at the ip level of the connections on the balancer so that there are no mixed sessions between updated and non-updated servers.

Answer 4

I was trying to install security update to Exchange server 2016 cu20 this night. The same error occurred after installation. When i try to apply above article, power shell gives a syntax error on second step, so the fix doesnt work. Could you help me?

Set-AuthConfig -NewCertificateThumbprint <ThumbprintFromStep1> -NewCertificateEffectiveDate (Get-Date)

The '<' operator is reserved for future use ...