After KB5004778 update, unable to access OWA & ECP (http code 500)

EM Support 41 Reputation points
2021-07-18T01:59:12.187+00:00

Exchange 2013 CU23
After login to OWA or ECP, I encountered http code 500.
Before that, I was updated security update KB5004778 (after a few failed attempts).
115623-image.png

I followed "OWA or ECP stops working after you install a security update" but failed.
https://learn.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/owa-stops-working-after-update
I run security update KB5004778 again without any issue.
But I still got http code 500.
Please advise, thanks.

Exchange | Exchange Server | Management
Exchange | Exchange Server | Management

The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.

Answer accepted by question author
Kai Yao 37,791 Reputation points Moderator
2021-07-19T01:40:56.317+00:00

Hi @EM Support

Sorry I need to add the following questions to get some more information:

  1. Is it a standalone Exchange server?
  2. Can you find some error events in the Event Viewer>Application log?
  3. Can Exchange Management Shell be opened without any problems?

And was the detailed HTTP 500 error message "HMACProvider.GetCertificates:protectionCertificates.Length<1"?

If it is the case, this issue may be caused by the OAuth certificate is missing or expired.
115669-15.jpg

Please run this command to first check if the OAuth certificate is missing or expired: 

Get-ExchangeCertificate (Get-AuthConfig).CurrentCertificateThumbprint

If there is no result returned or the OAuth certificate has expired, please follow this link to create a new OAuth certificate and see if it can get rid of the problem.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Was this answer helpful?

12 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ceyhun KIRMIZITAS 0 Reputation points Microsoft External Staff
    2026-09-08T18:51:48.73+00:00

    I recently reproduced a related scenario where the Exchange Auth Certificate was already valid and configured as Current, but Get-ExchangeCertificate was still returning blank output.

    The Exchange Data Serialization log showed:

    HmacCryptoProvider.HmacProvider==null

    The important part in my case was the certificate effective time. The certificate could already appear valid while the HMAC signing path still did not have an active key.

    I documented the lab tests, including the UTC timing behavior, here:

    https://ceyhunkirmizitas.net/get-exchangecertificate-blank-valid-auth-certificate/

    Was this answer helpful?

    0 comments
  2. alex a 61 Reputation points
    2021-08-25T14:51:59.193+00:00

    Worked for me too and take 2 hours and half

    Was this answer helpful?

    0 comments
  3. cbate 16 Reputation points
    2021-08-13T22:07:52.613+00:00

    We did the following to resolve the issue. A tip of the hat to ArunKumar.. comments were spot on.

    1. Find out what Exchange is using for the current auth certificate by running the following command:
      Get-ExchangeCertificate (Get-AuthConfig).CurrentCertificateThumbprint
    2. If you get an error running the command above, it means that the patch changed your auth certificate. You need to point exchange back to the correct certificate. To do that, you need to find the thumbprint of the auth certificate on your server. You can do this by running the following command:

    Get-ExchangeCertificate

    1. Look for the auth certificate on your exchange server and get the thumbprint of that certificate. Output of the Get-ExchangeCertificate follows:

    Thumbprint Subject

    7F7B8143A318C4E93796099E53D9D748F2FE0xxx CN=Microsoft Exchange Server Auth Certificate

    1. As other posters have mentioned, to point Exchange back to the correct certificate, run the following commands:

    Set-AuthConfig -NewCertificateThumbprint 7F7B8143A318C4E93796099E53D9D748F2FE0xxx -NewCertificateEffectiveDate (Get-Date)
    Set-AuthConfig -PublishCertificate
    Set-AuthConfig -ClearPreviousCertificate

    In our case, we restarted the server. You may also be able to get away with an IIS reset. Once the restart was done, the issue was resolved.

    Was this answer helpful?

    0 comments
  4. Andrew Kenny 6 Reputation points
    2021-08-13T22:00:34.793+00:00

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.