Solved

Unable to connect to Microsoft Federation Gateway

Posted on 2014-01-28
4
1,144 Views
Last Modified: 2014-03-23
Hello,

I'm having an issue connecting to the Microsoft Federation Gateway using Exchange 2010 SP3 RU4. The Federation has existed for months without issue and recently lost connection. Autodiscover is working as normal and all certificates are up to date (Federation Certificate is Self-Signed as per Microsoft Recommendation). Running Test-FederationTrust -verbose returns this error.

Test-FederationTrust : Failed to retrieve Federation Metadata from the Microsoft Federation Gateway. This operation will be retried in a few seconds. Last error: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSl/TLS secure channel. System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure

I have tried removing the Federation but the same error occurs on that CMDLET as well.

Any help is appreciated.
0
Comment
Question by:michd
  • 3
4 Comments
 
LVL 9

Expert Comment

by:nick2253
ID: 39815711
Somehow there's a problem is authenticating the connection.

Double check that your connection settings between the services are set to both use (or not use) encryption, etc.
0
 

Author Comment

by:michd
ID: 39815767
According to Microsoft Technet the connection should be going outbound over 443 and coming back in using Autodiscover service. I have tested the Autodiscover service using https://testconnectivity.microsoft.com/ and verified that traffic over 443 is allowed out from the Exchange servers and all appears well traffic wise.

Any other ideas?
0
 

Accepted Solution

by:
michd earned 0 total points
ID: 39938051
Ended up speaking with Microsoft Support on the issue. The root cause was that both local Exchange servers did not trust the SSL cert on the Microsoft Federation Gateway. Solution was to export the cert and import it onto each server
0
 

Author Closing Comment

by:michd
ID: 39948373
The issue was resolved through Microsoft support and my comment provides the solution.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This video discusses moving either the default database or any database to a new volume.

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now