Problem One, “HMACProvider.GetCertificates:protectionCertificates.Length<1”:

This image has an empty alt attribute; its file name is image-9-1024x508.png

Symptoms

When you try to sign in to Outlook on the web or the EAC in Exchange Server, the web browser freezes or reports that the redirect limit was reached. Additionally, Event 1003 is logged in the event viewer. For example, the following entry is logged:

Event ID: 1003
Source: MSExchange Front End HTTPS Proxy
[Owa] An internal server error occurred. The unhandled exception was: System.NullReferenceException: Object reference not set to an instance of an object.
   at Microsoft.Exchange.HttpProxy.FbaModule.ParseCadataCookies(HttpApplication httpApplication)

Cause

This issue occurs if the Exchange Server Open Authentication (OAuth) certificate is expired, not present, or not configured correctly.

Resolution

To Resolve this problem carry out the following:

  1. Open Exchange Management Shell as Administrator
  2. Run the following command. (Replace contoso.com with your SMTP domain)
New-ExchangeCertificate -KeySize 2048 -PrivateKeyExportable $true -SubjectName "cn=Microsoft Exchange Server Auth Certificate" -FriendlyName "Microsoft Exchange Server Auth Certificate" -DomainName "contoso.com"

3. Take note of your thumbprint, you’ll need it for the next command. Now run the rest of the commands.

Set-AuthConfig -NewCertificateThumbprint <ThumbprintFromStep1> -NewCertificateEffectiveDate (Get-Date)
Set-AuthConfig -PublishCertificate
Set-AuthConfig -ClearPreviousCertificate
Restart-Service MSExchangeServiceHost
Restart-WebAppPool MSExchangeOWAAppPool
Restart-WebAppPool MSExchangeECPAppPool

4. If you have multiple Exchange servers, you’ll need to run the following commands on each of them, but wait for the new Exchange Auth Certificate to be replicated to them first.

Restart-Service MSExchangeServiceHost
Restart-WebAppPool MSExchangeOWAAppPool
Restart-WebAppPool MSExchangeECPAppPool

 Wait, this can take a few hours-48hours to replicate across (more than the one hour Microsoft state), but then everything will start working again. If you wish to confirm each server is aware of the new Auth configuration you can run “Get-AuthConfig” and validate the Thumbprint and effective date match your new certificate and the time you executed the first “Set-AuthConfig” command respectively. If you have a Hybrid Exchange environment you need to rerun the “Hybrid Configuration Wizard” again to update these changes to Azure Active Directory.

(Get-AuthConfig).CurrentCertificateThumbprint | Get-ExchangeCertificate | Format-List

Good luck

Link Reference: https://docs.microsoft.com/en-us/exchange/troubleshoot/administration/cannot-access-owa-or-ecp-if-oauth-expired

Phương Nguyễn

Recommended Posts

Microsoft Outlook Zero-Day Vulnerability- Elevation of Privilege Vulnerability CVE-2023-23397
HƯỚNG DẪN DEPOLY HP607DN TRÊN AD Windows Server
Microsoft_Exchange_(2019-present).svg
HƯỚNG DẪN CÀI EXCHANGE SERVER 2019 CU12 TRÊN WINDOWS SERVER 2022
Chuyển dữ liệu ZaloPC sang ổ D, E.. để ổ C không bị đầy

12 Comments

  1. Thanks for your blog, nice to read. Do not stop.

  2. After I initially commented I clicked the -Notify me when new comments are added- checkbox and now each time a remark is added I get 4 emails with the same comment. Is there any method you can take away me from that service? Thanks!

  3. Nice post. I study one thing more difficult on different blogs everyday. It will always be stimulating to read content material from other writers and follow somewhat one thing from their store. I抎 prefer to make use of some with the content on my blog whether you don抰 mind. Natually I抣l give you a hyperlink on your net blog. Thanks for sharing.

  4. This web page can be a stroll-through for all the data you wanted about this and didn抰 know who to ask. Glimpse here, and also you抣l undoubtedly uncover it.

  5. Spot on with this write-up, I really think this web site needs rather more consideration. I抣l probably be again to read far more, thanks for that info.

  6. I抎 should examine with you here. Which isn’t one thing I normally do! I get pleasure from studying a publish that will make individuals think. Additionally, thanks for allowing me to comment!

  7. I precisely wished to appreciate you once more. I do not know what I would’ve done without the aspects provided by you over such area. It had become a real difficult issue in my view, however , witnessing the very specialized technique you treated it made me to weep with happiness. Now i am thankful for this advice and in addition hope that you really know what a great job you have been doing training some other people through your blog post. Most probably you have never got to know any of us.

  8. Thanks so much for providing individuals with a very spectacular possiblity to read critical reviews from here. It really is so enjoyable and as well , full of a good time for me personally and my office mates to visit your website at the least 3 times per week to find out the new guides you have. And lastly, I’m so at all times satisfied concerning the special concepts served by you. Some two facts in this posting are particularly the very best I’ve ever had.

  9. I simply wanted to appreciate you yet again. I’m not certain the things I could possibly have followed in the absence of these ideas shared by you concerning such a area of interest. It was actually an absolute challenging setting for me, but seeing the expert strategy you managed it forced me to jump over gladness. Now i’m grateful for your advice and then believe you realize what a great job you were providing training some other people via your webpage. Probably you have never encountered all of us.

  10. I have to show appreciation to you just for rescuing me from such a scenario. After browsing throughout the search engines and coming across ideas which were not pleasant, I thought my entire life was over. Living without the presence of approaches to the difficulties you have sorted out by way of your good article content is a critical case, and those that could have adversely damaged my entire career if I hadn’t come across the blog. That competence and kindness in playing with a lot of stuff was important. I don’t know what I would’ve done if I hadn’t come upon such a point like this. I can also at this point relish my future. Thanks a lot so much for the reliable and result oriented help. I will not think twice to suggest your web blog to anybody who should get care on this issue.

  11. I precisely had to thank you so much once more. I’m not certain what I would have carried out without these thoughts provided by you over that topic. Previously it was a real frightening case in my opinion, nevertheless considering the very specialised approach you processed that took me to cry over happiness. I am just happy for your work and expect you comprehend what a great job that you’re providing educating people today all through your blog. I am certain you have never got to know any of us.

Comments are closed for this article!