Expired Exchange Auth certificate: OWA/EAC redirect loops, Event ID 1003 and hybrid errors

Exchange signs server-to-server OAuth tokens with a self-signed certificate most admins never look at: the Microsoft Exchange Server Auth Certificate. Several Exchange security features rely on it as well. It's valid for five years, and when it expires or gets deleted, nothing on screen mentions a certificate. Instead, OWA and the EAC loop at sign-in, the shell misbehaves and hybrid features fail. In this post I'll match those symptoms to the certificate, prove it's the cause and replace it safely.

Symptoms#

Signing in to Outlook on the web or the Exchange admin center hangs, or the browser reports that the redirect limit was reached: ERR_TOO_MANY_REDIRECTS in Edge and Chrome, "The page isn't redirecting properly" in Firefox. At the same time the Application log on the Exchange servers records Event ID 1003 (MSExchange Front End HTTPS Proxy [Owa]):

Source:   MSExchange Front End HTTPS Proxy
Event ID: 1003
[Owa] An internal server error occurred. The unhandled exception was: System.NullReferenceException: Object reference not set to an instance of an object.
at Microsoft.Exchange.HttpProxy.FbaModule.ParseCadataCookies(HttpApplication httpApplication)

When you query the configured certificate in the Exchange Management Shell on a server that doesn't have it, you get:

A special Rpc error occurs on server <Servername>: The certificate with thumbprint <AuthCertificateThumbprint> was not found.

Other signs:

• Exchange Management Shell sessions stop working as expected.
• In hybrid, OAuth-based features such as free/busy between on-premises and Exchange Online fail. If the configured certificate has been deleted, the Hybrid Configuration Wizard (HCW) can fail with an OAuth error saying the authorization certificate with the configured thumbprint can't be found.
• Integrations that use server-to-server OAuth with SharePoint Server or Skype for Business Server can fail.

Why it happens#

When you install the first Exchange server, setup creates the self-signed Auth certificate and adds it to the organization's Auth configuration. A certificate servicelet in the Microsoft Exchange Service Host (MSExchangeServiceHost) replicates it to the other front-end servers. Exchange uses it to sign tokens for server-to-server trust (Exchange Online in hybrid, SharePoint Server, Skype for Business Server) and for several security features.

Exchange doesn't create a replacement by itself. Unless someone stages a successor, it expires five years after that first installation. It can also go missing: someone deletes "unused" self-signed certificates, or a server in another Active Directory site never receives it. Microsoft's support article links the sign-in loop and Event ID 1003 to an Auth certificate that's expired, missing or misconfigured. It lists Exchange 2019 CU12 and Exchange 2016 CU23 or later as the update to install, but an update doesn't make an expired certificate valid. For an expired or missing Auth certificate, Microsoft's instruction is to replace it immediately.

How to fix it#

1. Confirm the Auth certificate is the problem#

Get-AuthConfig | Format-List CurrentCertificateThumbprint, PreviousCertificateThumbprint, NextCertificateThumbprint, NextCertificateEffectiveDate
(Get-AuthConfig).CurrentCertificateThumbprint | Get-ExchangeCertificate | Format-List Subject, Thumbprint, NotBefore, NotAfter

# Is the current Auth certificate present on every server?
$thumb = (Get-AuthConfig).CurrentCertificateThumbprint
Get-ExchangeServer | Where-Object { -not $_.IsEdgeServer } | ForEach-Object {
  try { $c = Get-ExchangeCertificate -Server $_.Name -Thumbprint $thumb -ErrorAction Stop } catch { $c = $null }
  [pscustomobject]@{ Server = $_.Name; Present = [bool]$c; NotAfter = $c.NotAfter }
}

A NotAfter date in the past means the certificate has expired. Present = False means it's missing on that server. The Exchange Health Checker reports both, plus any next certificate that's waiting to take over.

2. Replace it with MonitorExchangeAuthCertificate.ps1#

Microsoft's CSS-Exchange script is the quickest safe fix. It renews an expired certificate, and it repairs a configuration where the current certificate isn't on every Mailbox server. Run it from an elevated Exchange Management Shell on a Mailbox server (not a machine with only the management tools), using an account in Organization Management:

.\MonitorExchangeAuthCertificate.ps1 -ValidateAndRenewAuthCertificate $true -Confirm:$false

# Some Exchange servers are offline or unreachable
.\MonitorExchangeAuthCertificate.ps1 -ValidateAndRenewAuthCertificate $true -IgnoreUnreachableServers $true -Confirm:$false

# Hybrid organization: renew anyway, then re-run the HCW
.\MonitorExchangeAuthCertificate.ps1 -ValidateAndRenewAuthCertificate $true -IgnoreHybridConfig $true -Confirm:$false

Each run writes a log under %ExchangeInstallPath%Logging\AuthCertificateMonitoring.

3. Or replace it by hand#

If you can't run the script, create a new certificate and make it active straight away. When New-ExchangeCertificate asks whether to overwrite the default SMTP certificate, answer N. If Set-AuthConfig asks you to confirm the effective date, confirm it.

$new = New-ExchangeCertificate -KeySize 2048 -PrivateKeyExportable $true `
  -SubjectName 'cn=Microsoft Exchange Server Auth Certificate' `
  -FriendlyName 'Microsoft Exchange Server Auth Certificate' -DomainName @()
Set-AuthConfig -NewCertificateThumbprint $new.Thumbprint -NewCertificateEffectiveDate (Get-Date)
Set-AuthConfig -PublishCertificate
Set-AuthConfig -ClearPreviousCertificate

# Then on every Exchange server with the Mailbox role
Restart-Service MSExchangeServiceHost
Restart-WebAppPool MSExchangeOWAAppPool
Restart-WebAppPool MSExchangeECPAppPool

The OWA and ECP application pools cache a reference to the Auth certificate, so they need recycling. If a server in another Active Directory site doesn't receive the new certificate, export it with Export-ExchangeCertificate and import it on a server in that site with Import-ExchangeCertificate. Replication takes care of the other servers in that site.

4. Hybrid: run the Hybrid Configuration Wizard again#

Exchange Online trusts your on-premises Auth certificate through the OAuth configuration that the HCW set up. Microsoft strongly recommends running the HCW again whenever the active certificate changes. Then test OAuth from an on-premises mailbox:

Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com/ews/exchange.asmx -Mailbox onprem.user@contoso.com -Verbose | Format-List

If the wizard itself fails, see Hybrid Configuration Wizard failures. If free/busy still doesn't work, see hybrid free/busy not working.

Verify the fix#

• Get-AuthConfig shows the new current thumbprint. Its certificate expires about five years from now, and the step 1 loop reports Present = True on every server.
• OWA and the EAC sign in normally in a fresh private browser window, and no new Event ID 1003 entries appear.
• When the AuthAdmin servicelet completes a staged rotation, it logs Event ID 2014 from MSExchange AuthAdmin: "The current signing certificate for Exchange has been updated to certificate with thumbprint …".
• In hybrid, Test-OAuthConnectivity reports success and free/busy works in both directions.

Prevent it next time#

• Let the script rotate the certificate for you. Run .\MonitorExchangeAuthCertificate.ps1 -ConfigureScriptToRunViaScheduledTask -Password (Get-Credential).Password to create a scheduled task. The user name you type is ignored, but the password must meet your password policy.
• If you'd rather rotate it yourself, stage the next certificate well before expiry. Microsoft's procedure sets the effective date 49 hours ahead; the full process is in renewing the SAN and Auth certificates.
• Before you remove any self-signed certificate, check Get-AuthConfig. Never delete the one it references.
• Monitor the Auth certificate's expiry date as you do your public certificate. Name mismatches on the public certificate cause different symptoms, covered in the Outlook security alert article.

References#

• Maintain the Exchange Server OAuth certificate (Microsoft Learn)
• Can't sign in to Outlook on the web or the EAC if the Exchange Server OAuth certificate is expired (Microsoft Learn)
• MonitorExchangeAuthCertificate (Microsoft CSS-Exchange)