Solved

Exchange 2K3 SP2 IIS6 RPC over HTTPS not working Self signed Certicates

Posted on 2014-01-23
2
102 Views
Last Modified: 2016-05-20
I run 6 Exchange servers All separate forest and domain roots. All have had Exchange 2K3SP2 RPC over https in IIS6 using self-signed certificates.

Outlook clients and the OS they have a trusted CA ROOT cert from the CA of the DOMAIN installed in local trusted store. Each domain has 2 or 3 RPC over https users. This has been functional for YEARS. NO issues,

I last configured a Windows 8.1 pro with office 2010 in Novemeber. Functional.
Tested Functional on local lan and externally.

Now externally RPC over HTTPS doesn't work. on 2 of the 6 servers.

IIS log during failure:
--------------------
2014-01-24 06:06:49 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:06:49 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:51 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:51 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:59 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:06:59 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:07:07 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:07:07 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
-----------------------

IIS LOG of LAN success:
--------------------
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:593 80 - <IIS INTERNAL IP> MSRPC 401 2 2148074254
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:593 80 - <IIS INTERNAL IP> MSRPC 401 2 2148074254
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 64
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:06 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:06 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 64
2014-01-24 02:45:07 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:07 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:09 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:09 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:10 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:10 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0

All Smart Phone ActiveSync works.
OWA works. HTTPS OWA connection from client TRUSTED in IE.

I'm not seeing to difference in the log files to indicate failure.
Now externally RPC over HTTPS doesn't work on 2 of the 6 servers.

3 separate laptops tested from external, All failed. All succeed internal. All W764 bit. Office 2003-10. All used to be functional.

No known changes except renewal is IIS cert in September for both nonfunctional servers.

Any CLues?
0
Comment
Question by:pmaxhammond
2 Comments
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 500 total points
ID: 39805762
I don't deploy RPC over HTTPS with self signed certificates for any reason whatsoever.
No point in my opinion, when you can get a trusted certificate for free (StartSSL).
Therefore I would suggest changing that to begin with. The later versions of Outlook are very picky over SSL certificates and on later versions of Exchange self signed certificates are not supported for this feature.

RPC over HTTPS fails for one of three reasons usually  - SSL trust, authentication or registry changes incorrect. Therefore I would go back through the registry changes and see if anything has been modified. If you were using a trusted SSL certificate I would suggest using the Microsoft tool at http://exrca.com/ - however that will fail because of the use of the self signed certificate.

Simon.
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are a web developer, you would be aware of the <iframe> tag in HTML. The <iframe> stands for inline frame and is used to embed another document within the current HTML document. The embedded document could be even another website.
Preparing an email is something we should all take special care with – especially when the email is for somebody you may not know very well. The pressures of everyday working life stacked with a hectic office environment can make this a real challen…
This video discusses moving either the default database or any database to a new volume.
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

816 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now