Exchange OWA Error (Something Went Wrong)

Exchange OWA Error (Something Went Wrong)

Exchange 2016 Cu8 on Windows Server 2012 R2 gave error on OWA, ECP will work if administrator doesn’t have a mailbox. else even ecp will throw the same error.

An unexpected error occurred and your request couldn't be handled.
X-ClientId: 15BED63F62FB4FDB809703ED2534C19D
request-id 1ac56275-a1ab-48cf-9f82-880c49767a19
X-OWA-Error Microsoft.Exchange.Diagnostics.ExAssertException
X-OWA-Version 15.1.1415.4
X-DAGServer COMM
X-DAGerver COMM

Date:11/07/2018 3:30:06 PM

Description:

Unable to find the certificate with thumbprint [Thumb code] in the current computer or the certificate is missing private key. The certificate is needed to sign the outgoing token. or invalid or expired 'Microsoft Exchange Server Auth Certificate'

Solution:

Create new Microsoft Exchange Server Auth Certificate 

1.     Open Exchange admin Center ECP, then go to servers, certificates, find Microsoft Exchange Server Auth Certificate then click on renew, Renewing creates a second certificate named Microsoft Exchange Server Auth Certificate that is valid for another 5 years. This certificate has a new thumbprint and exists only on the server you've renewed it on. You need to identify the thumbprint for the new certificate. If you edit the certificate, in Exchange Admin Center, the thumbprint is on the general tab. You can type this in, but you're probably better of to cut and paste it into the later commands.

2.     RDP to exchange server and open Exchange management shell

 $thumb = "NewCertificateThumbprint"

$date = get-date

Then run the following command to add the new certificate:

Set-AuthConfig -NewCertificateThumbprint $thumb -NewCertificateEffectiveDate $date

 You will get a warning that the new effective date is not 48 hours in the future. However,

 if we're recovering from an expired certificate, we're OK with that.

3.     Now you need to publish the certificate to all servers:

Set-AuthConfig -PublishCertificate

4.     And finally, remove the old expired certificate from the configuration:

Set-AuthConfig -ClearPreviousCertificate

5.     Finally, you can delete old one from all Exchange servers.

6.     You may need to do an iisreset PowerShell elevated mode after all of the AuthConfig changes were done. It’s possible that it will be done a restart but just take longer. and most likely it needs 60-180 Minutes per my experience.