Solved

Exchange 2K3 SP2 IIS6 RPC over HTTPS not working Self signed Certicates

Posted on 2014-01-23
2
105 Views
Last Modified: 2016-05-20
I run 6 Exchange servers All separate forest and domain roots. All have had Exchange 2K3SP2 RPC over https in IIS6 using self-signed certificates.

Outlook clients and the OS they have a trusted CA ROOT cert from the CA of the DOMAIN installed in local trusted store. Each domain has 2 or 3 RPC over https users. This has been functional for YEARS. NO issues,

I last configured a Windows 8.1 pro with office 2010 in Novemeber. Functional.
Tested Functional on local lan and externally.

Now externally RPC over HTTPS doesn't work. on 2 of the 6 servers.

IIS log during failure:
--------------------
2014-01-24 06:06:49 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:06:49 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:51 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:51 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:06:59 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:06:59 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 0
2014-01-24 06:07:07 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
2014-01-24 06:07:07 W3SVC1 HOSTNAME <IIS HOST LAN IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\USER <EXTERNAL IP> MSRPC 200 0 64
-----------------------

IIS LOG of LAN success:
--------------------
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:593 80 - <IIS INTERNAL IP> MSRPC 401 2 2148074254
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:593 80 - <IIS INTERNAL IP> MSRPC 401 2 2148074254
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 64
2014-01-24 02:45:05 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6002 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:06 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:06 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 64
2014-01-24 02:45:07 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:07 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:09 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:09 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:10 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_IN_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0
2014-01-24 02:45:10 W3SVC1 HOSTNAME <IIS INTERNAL IP> RPC_OUT_DATA /rpc/rpcproxy.dll HOSTNAME.DOMAIN.com:6004 443 DOMAIN\FuntionalUser <CLIENT INTERNAL IP> MSRPC 200 0 0

All Smart Phone ActiveSync works.
OWA works. HTTPS OWA connection from client TRUSTED in IE.

I'm not seeing to difference in the log files to indicate failure.
Now externally RPC over HTTPS doesn't work on 2 of the 6 servers.

3 separate laptops tested from external, All failed. All succeed internal. All W764 bit. Office 2003-10. All used to be functional.

No known changes except renewal is IIS cert in September for both nonfunctional servers.

Any CLues?
0
Comment
Question by:pmaxhammond
2 Comments
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 500 total points
ID: 39805762
I don't deploy RPC over HTTPS with self signed certificates for any reason whatsoever.
No point in my opinion, when you can get a trusted certificate for free (StartSSL).
Therefore I would suggest changing that to begin with. The later versions of Outlook are very picky over SSL certificates and on later versions of Exchange self signed certificates are not supported for this feature.

RPC over HTTPS fails for one of three reasons usually  - SSL trust, authentication or registry changes incorrect. Therefore I would go back through the registry changes and see if anything has been modified. If you were using a trusted SSL certificate I would suggest using the Microsoft tool at http://exrca.com/ - however that will fail because of the use of the self signed certificate.

Simon.
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question