Exchange 2013 / IIS / Certificate / EMS Gurus?

JaredBusch

@jasgot I can’t see your text clear enough while I’m driving. But I think I had a similar issue and @dbeato gave me the answer.

It was an extra binding in IIS that did not get properly updated.

JasGot

@jaredbusch Thanks! Hopefully he'll drop in.....

Dashrender

@jaredbusch said in Exchange 2013 / IIS / Certificate / EMS Gurus?:

@jasgot I can’t see your text clear enough while I’m driving. But I think I had a similar issue and @dbeato gave me the answer.

It was an extra binding in IIS that did not get properly updated.

Yeah, with the deletion of an old cert - a binding was the first thing I thought of.

dbeato

@jasgot right here...

dbeato

@dbeato Check this article

https://docs.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/owa-ecp-ems-cannot-connect-after-self-signed-certificate-removed

JasGot

@dbeato said in Exchange 2013 / IIS / Certificate / EMS Gurus?:

@dbeato Check this article

https://docs.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/owa-ecp-ems-cannot-connect-after-self-signed-certificate-removed

Thank you. I found that article a few days ago and followed it without success.

dbeato

@jasgot Also take a look here.
https://support.microsoft.com/en-us/topic/you-can-t-access-owa-or-ecp-after-you-install-exchange-server-2016-cu6-88b3fe67-5f97-a8a2-8ed8-70034ff15761

JasGot

@dbeato said in Exchange 2013 / IIS / Certificate / EMS Gurus?:

@jasgot Also take a look here.
https://support.microsoft.com/en-us/topic/you-can-t-access-owa-or-ecp-after-you-install-exchange-server-2016-cu6-88b3fe67-5f97-a8a2-8ed8-70034ff15761

Thanks. This looks helpful, I'll give it a try!

JasGot

No go. Open to other ideas.....

pirho99

@jasgot
Run this on EMS:
netsh http show sslcert

0.0.0.0:443
0.0.0.0:444
127.0.0.1:443

should have the same Certificate Hash / Thumbprint
(take a screenshot)

Whichever one doesn't match - delete

netsh http delete sslcert ipport=0.0.0.0:444 (for example)

Then reload that with the right cert

netsh http add sslcert ipport=0.0.0.0:444 appid='{app id}' certhash=<correct thumbprint>
(or whichever ip/port didn't match earlier)

Then run netsh http show sslcert again to confirm the change!

JasGot

@pirho99 said in Exchange 2013 / IIS / Certificate / EMS Gurus?:

Run this on EMS:
netsh http show sslcert
......

Hadn't seen these steps before, thanks. But no glory

dbeato

@jasgot What is the Service Pack and CU Leval of that Exchange 2013 Server? What is the .NET Framework installed on this server?

JasGot

@dbeato said in Exchange 2013 / IIS / Certificate / EMS Gurus?:

@jasgot What is the Service Pack and CU Leval of that Exchange 2013 Server? What is the .NET Framework installed on this server?

CU 23
Net 4.8

dbeato

@jasgot Gotcha, that is very bizarre.

JasGot

@dbeato is the man of the hour today. He had the idea to remove and re create the Exchange Powershell directory and the Exchange Management Shell capabilities were restored.

Kudos to @dbeato !