Solved

Exchange 2K3 SP2 IIS6 RPC over HTTPS not working Self signed Certicates

Posted on 2014-01-23
2
109 Views
Last Modified: 2016-05-20
I run 6 Exchange servers All separate forest and domain roots. All have had Exchange 2K3SP2 RPC over https in IIS6 using self-signed certificates.

Outlook clients and the OS they have a trusted CA ROOT cert from the CA of the DOMAIN installed in local trusted store. Each domain has 2 or 3 RPC over https users. This has been functional for YEARS. NO issues,

I last configured a Windows 8.1 pro with office 2010 in Novemeber. Functional.
Tested Functional on local lan and externally.

Now externally RPC over HTTPS doesn't work. on 2 of the 6 servers.

IIS log during failure:
--------------------
2014-01-24 06:06:49 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:06:49 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:51 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:51 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:59 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:06:59 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:07:07 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:07:07 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
-----------------------

IIS LOG of LAN success:
--------------------
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:593 80 - <IIS INTERNAL IP> MSRPC 401 2 2148074254
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:593 80 - <IIS INTERNAL IP> MSRPC 401 2 2148074254
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 64
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:06 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:06 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 64
2014-01-24 02:45:07 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:07 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:09 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:09 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:10 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:10 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0

All Smart Phone ActiveSync works.
OWA works. HTTPS OWA connection from client TRUSTED in IE.

I'm not seeing to difference in the log files to indicate failure.
Now externally RPC over HTTPS doesn't work on 2 of the 6 servers.

3 separate laptops tested from external, All failed. All succeed internal. All W764 bit. Office 2003-10. All used to be functional.

No known changes except renewal is IIS cert in September for both nonfunctional servers.

Any CLues?
0
Comment
Question by:pmaxhammond
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 500 total points
ID: 39805762
I don't deploy RPC over HTTPS with self signed certificates for any reason whatsoever.
No point in my opinion, when you can get a trusted certificate for free (StartSSL).
Therefore I would suggest changing that to begin with. The later versions of Outlook are very picky over SSL certificates and on later versions of Exchange self signed certificates are not supported for this feature.

RPC over HTTPS fails for one of three reasons usually  - SSL trust, authentication or registry changes incorrect. Therefore I would go back through the registry changes and see if anything has been modified. If you were using a trusted SSL certificate I would suggest using the Microsoft tool at http://exrca.com/ - however that will fail because of the use of the self signed certificate.

Simon.
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Preparing an email is something we should all take special care with – especially when the email is for somebody you may not know very well. The pressures of everyday working life stacked with a hectic office environment can make this a real challen…
Check out this step-by-step guide for using the newly updated Experts Exchange mobile app—released on May 30.
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…
Suggested Courses

615 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question