Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Exchange 2K3 SP2 IIS6 RPC over HTTPS not working Self signed Certicates

Posted on 2014-01-23
2
Medium Priority
?
115 Views
Last Modified: 2016-05-20
I run 6 Exchange servers All separate forest and domain roots. All have had Exchange 2K3SP2 RPC over https in IIS6 using self-signed certificates.

Outlook clients and the OS they have a trusted CA ROOT cert from the CA of the DOMAIN installed in local trusted store. Each domain has 2 or 3 RPC over https users. This has been functional for YEARS. NO issues,

I last configured a Windows 8.1 pro with office 2010 in Novemeber. Functional.
Tested Functional on local lan and externally.

Now externally RPC over HTTPS doesn't work. on 2 of the 6 servers.

IIS log during failure:
--------------------
2014-01-24 06:06:49 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:06:49 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:51 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:51 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:59 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:06:59 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:07:07 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:07:07 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
-----------------------

IIS LOG of LAN success:
--------------------
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:593 80 - <IIS INTERNAL IP> MSRPC 401 2 2148074254
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:593 80 - <IIS INTERNAL IP> MSRPC 401 2 2148074254
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 64
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:06 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:06 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 64
2014-01-24 02:45:07 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:07 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:09 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:09 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:10 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:10 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0

All Smart Phone ActiveSync works.
OWA works. HTTPS OWA connection from client TRUSTED in IE.

I'm not seeing to difference in the log files to indicate failure.
Now externally RPC over HTTPS doesn't work on 2 of the 6 servers.

3 separate laptops tested from external, All failed. All succeed internal. All W764 bit. Office 2003-10. All used to be functional.

No known changes except renewal is IIS cert in September for both nonfunctional servers.

Any CLues?
0
Comment
Question by:pmaxhammond
2 Comments
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 2000 total points
ID: 39805762
I don't deploy RPC over HTTPS with self signed certificates for any reason whatsoever.
No point in my opinion, when you can get a trusted certificate for free (StartSSL).
Therefore I would suggest changing that to begin with. The later versions of Outlook are very picky over SSL certificates and on later versions of Exchange self signed certificates are not supported for this feature.

RPC over HTTPS fails for one of three reasons usually  - SSL trust, authentication or registry changes incorrect. Therefore I would go back through the registry changes and see if anything has been modified. If you were using a trusted SSL certificate I would suggest using the Microsoft tool at http://exrca.com/ - however that will fail because of the use of the self signed certificate.

Simon.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

On September 18, Experts Exchange launched the first installment of the Help Bell, a new feature for Premium Members, Team Accounts, and Qualified Experts. The Help Bell will serve as an additional tool to help teams increase question visibility.
Steps to fix “Unable to mount database. (hr=0x80004005, ec=1108)”.
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
Suggested Courses

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question