Solved

Exchange 2K3 SP2 IIS6 RPC over HTTPS not working Self signed Certicates

Posted on 2014-01-23
2
99 Views
Last Modified: 2016-05-20
I run 6 Exchange servers All separate forest and domain roots. All have had Exchange 2K3SP2 RPC over https in IIS6 using self-signed certificates.

Outlook clients and the OS they have a trusted CA ROOT cert from the CA of the DOMAIN installed in local trusted store. Each domain has 2 or 3 RPC over https users. This has been functional for YEARS. NO issues,

I last configured a Windows 8.1 pro with office 2010 in Novemeber. Functional.
Tested Functional on local lan and externally.

Now externally RPC over HTTPS doesn't work. on 2 of the 6 servers.

IIS log during failure:
--------------------
2014-01-24 06:06:49 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:06:49 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:51 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:51 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:59 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:06:59 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:07:07 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:07:07 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
-----------------------

IIS LOG of LAN success:
--------------------
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:593 80 - <IIS INTERNAL IP> MSRPC 401 2 2148074254
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:593 80 - <IIS INTERNAL IP> MSRPC 401 2 2148074254
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 64
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:06 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:06 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 64
2014-01-24 02:45:07 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:07 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:09 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:09 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:10 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:10 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0

All Smart Phone ActiveSync works.
OWA works. HTTPS OWA connection from client TRUSTED in IE.

I'm not seeing to difference in the log files to indicate failure.
Now externally RPC over HTTPS doesn't work on 2 of the 6 servers.

3 separate laptops tested from external, All failed. All succeed internal. All W764 bit. Office 2003-10. All used to be functional.

No known changes except renewal is IIS cert in September for both nonfunctional servers.

Any CLues?
0
Comment
Question by:pmaxhammond
2 Comments
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 500 total points
ID: 39805762
I don't deploy RPC over HTTPS with self signed certificates for any reason whatsoever.
No point in my opinion, when you can get a trusted certificate for free (StartSSL).
Therefore I would suggest changing that to begin with. The later versions of Outlook are very picky over SSL certificates and on later versions of Exchange self signed certificates are not supported for this feature.

RPC over HTTPS fails for one of three reasons usually  - SSL trust, authentication or registry changes incorrect. Therefore I would go back through the registry changes and see if anything has been modified. If you were using a trusted SSL certificate I would suggest using the Microsoft tool at http://exrca.com/ - however that will fail because of the use of the self signed certificate.

Simon.
0

Featured Post

Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Since pre-biblical times, humans have sought ways to keep secrets, and share the secrets selectively.  This article explores the ways PHP can be used to hide and encrypt information.
MS Outlook is a world-class email client application that is mainly used for e-communication globally.  In this article, we will discuss the basic idea about MS Outlook, its advanced features, and types of MS Outlook File formats.
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…

948 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now