Share via

After KB5004778 update, unable to access OWA & ECP (http code 500)

EM Support 36 Reputation points
2021-07-18T01:59:12.187+00:00

Exchange 2013 CU23
After login to OWA or ECP, I encountered http code 500.
Before that, I was updated security update KB5004778 (after a few failed attempts).
115623-image.png

I followed "OWA or ECP stops working after you install a security update" but failed.
https://learn.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/owa-stops-working-after-update
I run security update KB5004778 again without any issue.
But I still got http code 500.
Please advise, thanks.

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,426 questions
Accepted answer
  1. Kael Yao-MSFT 37,586 Reputation points Microsoft Vendor
    2021-07-19T01:40:56.317+00:00

    Hi @EM Support

    Sorry I need to add the following questions to get some more information:

    1. Is it a standalone Exchange server?
    2. Can you find some error events in the Event Viewer>Application log?
    3. Can Exchange Management Shell be opened without any problems?

    And was the detailed HTTP 500 error message "HMACProvider.GetCertificates:protectionCertificates.Length<1"?

    If it is the case, this issue may be caused by the OAuth certificate is missing or expired.
    115669-15.jpg

    Please run this command to first check if the OAuth certificate is missing or expired: 

    Get-ExchangeCertificate (Get-AuthConfig).CurrentCertificateThumbprint

    If there is no result returned or the OAuth certificate has expired, please follow this link to create a new OAuth certificate and see if it can get rid of the problem.

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

11 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andrew Kenny 6 Reputation points
    2021-08-13T22:00:34.793+00:00
  2. cbate 16 Reputation points
    2021-08-13T22:07:52.613+00:00

    We did the following to resolve the issue. A tip of the hat to ArunKumar.. comments were spot on.

    1. Find out what Exchange is using for the current auth certificate by running the following command:
      Get-ExchangeCertificate (Get-AuthConfig).CurrentCertificateThumbprint
    2. If you get an error running the command above, it means that the patch changed your auth certificate. You need to point exchange back to the correct certificate. To do that, you need to find the thumbprint of the auth certificate on your server. You can do this by running the following command:

    Get-ExchangeCertificate

    1. Look for the auth certificate on your exchange server and get the thumbprint of that certificate. Output of the Get-ExchangeCertificate follows:

    Thumbprint Subject

    7F7B8143A318C4E93796099E53D9D748F2FE0xxx CN=Microsoft Exchange Server Auth Certificate

    1. As other posters have mentioned, to point Exchange back to the correct certificate, run the following commands:

    Set-AuthConfig -NewCertificateThumbprint 7F7B8143A318C4E93796099E53D9D748F2FE0xxx -NewCertificateEffectiveDate (Get-Date)
    Set-AuthConfig -PublishCertificate
    Set-AuthConfig -ClearPreviousCertificate

    In our case, we restarted the server. You may also be able to get away with an IIS reset. Once the restart was done, the issue was resolved.

    0 comments
  3. alex a 61 Reputation points
    2021-08-25T14:51:59.193+00:00

    Worked for me too and take 2 hours and half

    0 comments