OWA stopped working after updating certificate in on-prem exchange server exchange 2016

Question

Hello I have asked a question different portal in exchange and they suggested to check here.

Please help.

Question in another portal:

https://answers.microsoft.com/en-us/outlook_com/forum/all/owa-stopped-working-after-updating-certificate-in/36dc9ce4-a610-449d-a6bb-3f843133bb43

Attached the screenshot of the error, and below is the writeup:

Hello,

I have recently updated the SSL certificate for Exchange server for the URL and after updating i got error for ECP portal:

Image

I checked in event viewer and got this error:

[Owa] An internal server error occurred. The unhandled exception was: System.NullReferenceException: Object reference not set to an instance of an object.
at Microsoft.Exchange.HttpProxy.FbaModule.ParseCadataCookies(HttpApplication httpApplication)
at Microsoft.Exchange.HttpProxy.FbaModule.OnBeginRequestInternal(HttpApplication httpApplication)
at Microsoft.Exchange.HttpProxy.ProxyModule.<>c__DisplayClass16_0.<OnBeginRequest>b__0()
at Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action tryDelegate, Func2 filterDelegate, Action1 catchDelegate)

Image

Followed the steps as suggested:

https://learn.microsoft.com/en-us/exchange/troubleshoot/administration/cannot-access-owa-or-ecp-if-oauth-expired

but I can see the certificate is not expired:

Image

Still I tried to follow the process further and generated a new certificate and when in tried set-authconfig got this error:

Image

please help on this issue.

Answer 1

Hi @Abhishek Kumar

This issue occurs if the Exchange Server Open Authentication (OAuth) certificate is expired, not present, or not configured correctly.

According to the screenshot of Get-AuthConfig that you provided, the main cause for this issue is not that the certificate expires, but because the Microsoft Exchange Server Auth Certificate is not present.
When you run the set-authconfig command, please replace <ThumbprintFromStep1> with the newly generated Thumbprint by copy-pasting it directly to avoid typing the wrong characters and manually.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

To fix this issue, install the latest cumulative update for Exchange Server 2019.
Check these articles for help - https://support.microsoft.com/en-us/topic/event-ids-1003-1309-and-4999-are-logged-after-installing-exchange-server-2019-cu8-1295c555-d590-4a06-a53a-c14a0f363ee3
https://www.stellarinfo.com/blog/microsoft-exchange-remote-code-execution-vulnerability-flaws-and-fixes/

Also, try to replace the backend self-signed certificate for the new certificate. Do not replace those. Keep the self-signed.