After KB5004778 update, unable to access OWA & ECP (http code 500)

EM Support 41

Exchange 2013 CU23
After login to OWA or ECP, I encountered http code 500.
Before that, I was updated security update KB5004778 (after a few failed attempts).

I followed "OWA or ECP stops working after you install a security update" but failed.
https://learn.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/owa-stops-working-after-update
I run security update KB5004778 again without any issue.
But I still got http code 500.
Please advise, thanks.

Dmitriy Samorodov 1 Reputation point

2021-07-19T11:22:06.19+00:00

After installing updates kb5004778

https://mail.ourexchange.com/owa/auth/errorFE.aspx?httpCode=500

X-ClientId: SSLX - LPN0 - IOTY - WLWHQW
X-FEServer: MAIL
Date: 19.07.2021 11:19:36

Answer accepted by question author

Kai Yao 37,791 Moderator

Hi @EM Support

Sorry I need to add the following questions to get some more information:

Is it a standalone Exchange server?
Can you find some error events in the Event Viewer>Application log?
Can Exchange Management Shell be opened without any problems?

And was the detailed HTTP 500 error message "HMACProvider.GetCertificates:protectionCertificates.Length<1"?

If it is the case, this issue may be caused by the OAuth certificate is missing or expired.

Please run this command to first check if the OAuth certificate is missing or expired:

Get-ExchangeCertificate (Get-AuthConfig).CurrentCertificateThumbprint

If there is no result returned or the OAuth certificate has expired, please follow this link to create a new OAuth certificate and see if it can get rid of the problem.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Kai Yao 37,791 Reputation points Moderator

2021-07-22T01:08:06.643+00:00

Hi @EM Support

I am writing here to confirm with you how thing going now?
Did the issue get resolved?
Mitchell Moore 1 Reputation point

2021-07-22T02:50:37.867+00:00

KaelYao,
I am having a similar issue with my exchange environment? Any way we can connect somehow?
Kai Yao 37,791 Reputation points Moderator

2021-07-22T02:59:42.803+00:00

Hi,
Sorry but here we mainly focus on supporting via forum posts.

If your issue is very urgent, please consider opening a support ticket via phone.
You can get the numbers in this link: Global Customer Service phone numbers

Besides, did the recreating new OAuth certificate solution not work for you?

12 additional answers

Manu Philip 20,661 Reputation points MVP Volunteer Moderator

2021-07-18T02:41:48.877+00:00

Can you check, if the bindings are assigned correctly in IIS console for both websites (Default website and Exchange Backend)
Was this answer helpful?
EM Support 41 Reputation points

2021-07-18T03:17:52.897+00:00

I have tried to create new certificate but still unable to access OWA or ECP.
https://learn.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/owa-ecp-ems-cannot-connect-after-self-signed-certificate-removed

EM Support 41 Reputation points

2021-07-18T03:20:15.087+00:00

Yes the binding is correct.

Manu Philip 20,661 Reputation points MVP Volunteer Moderator

2021-07-18T03:22:39.99+00:00

Let's know what are the certificates have been created?

Have you set the bindings as explained in my previous comment?

EM Support 41 Reputation points

2021-07-18T03:23:07.023+00:00

I also tried both solutions.
https://social.technet.microsoft.com/wiki/contents/articles/34020.exchange-2013-troubleshooting-error-500-when-login-ecp-and-owa.aspx

EM Support 41 Reputation points

2021-07-18T03:26:04.457+00:00

Microsoft Exchange

yes.

Manu Philip 20,661 Reputation points MVP Volunteer Moderator

2021-07-18T03:38:11.7+00:00

Against each 443 bindings, make sure that you have the right certificates assigned. Are you using thirdparty SSL? is it expired or still valid?
What about the expiry conditions of other certificates?

Manu Philip 20,661 Reputation points MVP Volunteer Moderator

2021-07-18T03:50:04.783+00:00

Few other checks. Looks like you have fixed something else during the installation (as you mentioned in the initial question).

Check, if the CU has been installed correctly?

Check exchange server version using PS command and make sure that the right version is installed

Verify the Exchange setup log found under C:\ drive and see if the installation went well.

Have you seen that all the services are started well in services console?

Check, if you have any events reported in event log indicating a related issue

EM Support 41 Reputation points

2021-07-18T09:34:14.637+00:00

yes, self-signed certificate for 443 bindings. Not thirdparty SSL.
Still valid, up to 2023.

EM Support 41 Reputation points

2021-07-18T09:40:51.757+00:00

1) yes, CU23 installed on 2019.
2) Exchange Server version is 15.00.1497.023
3) i have checked it, installation completed without error.
4) All Exchange services are running.
5) i still checking the event logs.

EM Support 41 Reputation points

2021-07-18T12:31:32.737+00:00

Solution2:
after clear values of msExchCanaryData0, msExchCanaryData1 and msExchCanaryData2 and recycle MSExchangeOWAAppPool, does msExchCanaryData0 to 2 filled with values?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Giorgio Busoni 1 Reputation point

2021-07-19T18:52:04.89+00:00

I also have the same issue. I tried to run the command, it returned a thumbprint. Servercis: only S listed
I have checked the binding, seems correct. Default website has the usuale certificate, while backend has no certificate assigned
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Giorgio Busoni 1 Reputation point

2021-07-19T22:55:27.547+00:00

i solved using https://learn.microsoft.com/en-us/exchange/troubleshoot/administration/cannot-access-owa-or-ecp-if-oauth-expired
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Arunkumar Mayakrishnan 1 Reputation point

2021-07-20T07:39:01.14+00:00

The Microsoft Exchange Server Auth Certificate got pointed to a wrong expired one, causing this issue.

To fix it first, check whether the Auth certificate using the below command. If it's not pointed to the correct one, then it needs to be replaced with the correct one.

Get-ExchangeCertificate (Get-AuthConfig).CurrentCertificateThumbprint

To replace the correct certificate :
Set-AuthConfig -NewCertificateThumbprint <correctMSAuththumprint> -NewCertificateEffectiveDate (Get-Date)
Set-AuthConfig -PublishCertificate
Set-AuthConfig -ClearPreviousCertificate
Was this answer helpful?
cbate 16 Reputation points

2021-08-04T21:04:30.563+00:00

Thanks for posting this. It was spot on. Appears that the patch changes the Auth certificate for some reason. To resolve this issue, we did the following:

Find out what Exchange is using for the current auth certificate by running the following command:
Get-ExchangeCertificate (Get-AuthConfig).CurrentCertificateThumbprint

If you get an error running the command above, it means that the patch changed your auth certificate. You need to point exchange back to the correct certificate. To do that, you need to find the thumbprint of the auth certificate on your server. You can do this by running the following command:

Get-ExchangeCertificate

3.. Look for the auth certificate on your exchange server and get the thumbprint of that certificate. Output of the Get-ExchangeCertificate follows:

Thumbprint Subject

7F7B8143A318C4E93796099E53D9D748F2FE0xxx CN=Microsoft Exchange Server Auth Certificate

As other posters have mentioned, to point Exchange back to the correct certificate, run the following commands:

Set-AuthConfig -NewCertificateThumbprint 7F7B8143A318C4E93796099E53D9D748F2FE0xxx -NewCertificateEffectiveDate (Get-Date)
Set-AuthConfig -PublishCertificate
Set-AuthConfig -ClearPreviousCertificate

In our case, we restarted the server. You may also be able to get away with an IIS reset. Once the restart was done, the issue was resolved.

Sebastijan Ženko 1 Reputation point

2021-08-12T09:23:42.487+00:00

This solution works!

Gagan Deep 1 Reputation point

2021-09-18T09:44:57.437+00:00

It worked for me.

--> Restart is required.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

After KB5004778 update, unable to access OWA & ECP (http code 500)

12 additional answers

Your answer