After KB5004778 update, unable to access OWA & ECP (http code 500)

EM Support 41

Exchange 2013 CU23
After login to OWA or ECP, I encountered http code 500.
Before that, I was updated security update KB5004778 (after a few failed attempts).

I followed "OWA or ECP stops working after you install a security update" but failed.
https://learn.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/owa-stops-working-after-update
I run security update KB5004778 again without any issue.
But I still got http code 500.
Please advise, thanks.

Dmitriy Samorodov 1 Reputation point

2021-07-19T11:22:06.19+00:00

After installing updates kb5004778

https://mail.ourexchange.com/owa/auth/errorFE.aspx?httpCode=500

X-ClientId: SSLX - LPN0 - IOTY - WLWHQW
X-FEServer: MAIL
Date: 19.07.2021 11:19:36

Answer accepted by question author

Kai Yao 37,791 Moderator

Hi @EM Support

Sorry I need to add the following questions to get some more information:

Is it a standalone Exchange server?
Can you find some error events in the Event Viewer>Application log?
Can Exchange Management Shell be opened without any problems?

And was the detailed HTTP 500 error message "HMACProvider.GetCertificates:protectionCertificates.Length<1"?

If it is the case, this issue may be caused by the OAuth certificate is missing or expired.

Please run this command to first check if the OAuth certificate is missing or expired:

Get-ExchangeCertificate (Get-AuthConfig).CurrentCertificateThumbprint

If there is no result returned or the OAuth certificate has expired, please follow this link to create a new OAuth certificate and see if it can get rid of the problem.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Kai Yao 37,791 Reputation points Moderator

2021-07-22T01:08:06.643+00:00

Hi @EM Support

I am writing here to confirm with you how thing going now?
Did the issue get resolved?
Mitchell Moore 1 Reputation point

2021-07-22T02:50:37.867+00:00

KaelYao,
I am having a similar issue with my exchange environment? Any way we can connect somehow?
Kai Yao 37,791 Reputation points Moderator

2021-07-22T02:59:42.803+00:00

Hi,
Sorry but here we mainly focus on supporting via forum posts.

If your issue is very urgent, please consider opening a support ticket via phone.
You can get the numbers in this link: Global Customer Service phone numbers

Besides, did the recreating new OAuth certificate solution not work for you?

11 additional answers

KTC_Church 21 Reputation points

2021-08-03T14:03:00.36+00:00

@Fares Istaitieh , yes, proceed. My cert wasn't expired either and I did the steps anyway and it fixed my issue.
Was this answer helpful?
Fares Istaitieh 1 Reputation point

2021-08-07T06:09:15.8+00:00

It works well, thank you.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Fares Istaitieh 1 Reputation point

2021-08-01T09:41:26.19+00:00

Hi @Kai Yao

I have the same issue with exchange 2013 after installing: Exchange2013-KB5004778-x64-en.
I'm just reading the link you add https://learn.microsoft.com/en-us/exchange/troubleshoot/administration/cannot-access-owa-or-ecp-if-oauth-expired#resolution
but before I start i just found that my current certificate not expired, so should i proceed with the steps of creating a new one or there is any other solution
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Arunkumar Mayakrishnan 1 Reputation point

2021-07-20T07:39:01.14+00:00

The Microsoft Exchange Server Auth Certificate got pointed to a wrong expired one, causing this issue.

To fix it first, check whether the Auth certificate using the below command. If it's not pointed to the correct one, then it needs to be replaced with the correct one.

Get-ExchangeCertificate (Get-AuthConfig).CurrentCertificateThumbprint

To replace the correct certificate :
Set-AuthConfig -NewCertificateThumbprint <correctMSAuththumprint> -NewCertificateEffectiveDate (Get-Date)
Set-AuthConfig -PublishCertificate
Set-AuthConfig -ClearPreviousCertificate
Was this answer helpful?
cbate 16 Reputation points

2021-08-04T21:04:30.563+00:00

Thanks for posting this. It was spot on. Appears that the patch changes the Auth certificate for some reason. To resolve this issue, we did the following:

Find out what Exchange is using for the current auth certificate by running the following command:
Get-ExchangeCertificate (Get-AuthConfig).CurrentCertificateThumbprint

If you get an error running the command above, it means that the patch changed your auth certificate. You need to point exchange back to the correct certificate. To do that, you need to find the thumbprint of the auth certificate on your server. You can do this by running the following command:

Get-ExchangeCertificate

3.. Look for the auth certificate on your exchange server and get the thumbprint of that certificate. Output of the Get-ExchangeCertificate follows:

Thumbprint Subject

7F7B8143A318C4E93796099E53D9D748F2FE0xxx CN=Microsoft Exchange Server Auth Certificate

As other posters have mentioned, to point Exchange back to the correct certificate, run the following commands:

Set-AuthConfig -NewCertificateThumbprint 7F7B8143A318C4E93796099E53D9D748F2FE0xxx -NewCertificateEffectiveDate (Get-Date)
Set-AuthConfig -PublishCertificate
Set-AuthConfig -ClearPreviousCertificate

In our case, we restarted the server. You may also be able to get away with an IIS reset. Once the restart was done, the issue was resolved.

Sebastijan Ženko 1 Reputation point

2021-08-12T09:23:42.487+00:00

This solution works!

Gagan Deep 1 Reputation point

2021-09-18T09:44:57.437+00:00

It worked for me.

--> Restart is required.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Giorgio Busoni 1 Reputation point

2021-07-19T22:55:27.547+00:00

i solved using https://learn.microsoft.com/en-us/exchange/troubleshoot/administration/cannot-access-owa-or-ecp-if-oauth-expired
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

After KB5004778 update, unable to access OWA & ECP (http code 500)

11 additional answers

Your answer