OWA/ECP Breaks if "Microsoft Exchange Server Auth Certificate" is Expired

  • Article

If the "Microsoft Exchange Server Auth Certificate"  certificate isn't present on Exchange servers in the organization, follow these steps to create and deploy a new OAuth certificate to the Exchange server:

  1. Create a new OAuth certificate by running the following command:

    New-ExchangeCertificate -KeySize 2048 -PrivateKeyExportable $true -SubjectName "cn=Microsoft Exchange Server Auth Certificate" -FriendlyName "Microsoft Exchange Server Auth Certificate" -DomainName "contoso.com"

    Note Change the value of the DomainNameparameter in the example (contoso.com) to the SMTP domain that's used in your organization.

  2. Set the created certificate to be used for server authentication by running the following commands:

    Set-AuthConfig -NewCertificateThumbprint <ThumbprintFromStep1> -NewCertificateEffectiveDate (Get-Date)
    Set-AuthConfig –PublishCertificate
    Set-AuthConfig -ClearPreviousCertificate

  3. Restart the Microsoft Exchange Service Host Service.

  4. Either run the IISReset command to restart IIS or run the following commands (in elevated mode) to recycle OWA and ECP Application pools:

    Restart-WebAppPool MSExchangeOWAAppPool
    Restart-WebAppPool MSExchangeECPAppPool

    NoteIn some environments, it may take an hour for the OAuth certificate to be published.