Exchange Server OWA and ECP not working (Exchange 16/19)

I recently carried out restarts on my exchange servers after successful installation latest batch of Windows Updates and realized that the OWA and ECP were no longer working on some of the servers. This seems to have affected the exchange 2016 and 2019 versions. The Outlook on the desktop as well as the Outlook on Mobiles worked fine. After logging in to the OWA/ECP, you are met with a “Something went wrong” error message with a 500 Error message under the navigation bar.

I experienced this error in January 2022, which means that the security update must have been installed around November/December 2021. When authentication fails, two entries are generated in the event viewer under Application: EventID 1003 (MSExchange Front End HTTP Proxy) and EventID 1309 (ASP.NET 4.0.30319.0). The latter clearly indicates that there is an issue with the certificate.

It turned out that the Exchange Server Auth Certificate was expired, just a few days ago. You can see this when running the below command:

(Get-AuthConfig).CurrentCertificateThumbprint | Get-ExchangeCertificate | Format-List

You can resolve the problem using the below command:

New-ExchangeCertificate -KeySize 2048 -PrivateKeyExportable $true -SubjectName "cn=Microsoft Exchange Server Auth Certificate" -FriendlyName "Microsoft Exchange Server Auth Certificate" -DomainName @()

When the certificate is created, the AuthConfig needs to be configured, it needs to be published and the old certificate needs to be removed. Use the set-auth command to configure this.

Set-AuthConfig -NewCertificateThumbprint 309263C8C5B2DA9612E8A6FA9AAABBBCCCDDD -NewCertificateEffectiveDate (Get-Date)

Once completed, you shall require to restart the Microsoft Exchange Service Host service and perform an IISRESET. If you cannot run the IISRESET, you can go ahead and recycle both the OWA and ECP App Pool using the below commands:

Restart-WebAppPool MSExchangeOWAAppPool
Restart-WebAppPool MSExchangeECPAppPool

In my case, I had to wait an hour while as well as restart the server for the problem to be resolved. I would not be worried if the problem isn’t resolved immediately.

NOTE: If you are running multiple exchange servers, you shall have to execute the above steps on one server only and NOT on all servers.