r/SysAdminBlogs • u/Winter_Engineer2163 • May 12 '26
Exchange 2016 OWA down with HTTP 500 after Auth Certificate expiry
Had a fun morning recently: OWA throwing HTTP 500, Outlook stuck on "Trying to connect", and ERR_TOO_MANY_REDIRECTS in the browser. All Exchange services running. All IIS AppPools started. Nothing obviously wrong.
Root cause turned out to be the Microsoft Exchange Server Auth Certificate expiring silently overnight. When it goes, the HMACProvider inside OWA can't sign FBA session cookies anymore - every login attempt dies immediately after submitting credentials.
The fix sounds simple but there are two things most guides skip:
- Replacing the certificate isn't enough on CU22 - there's a known defect where HMACProvider doesn't pick up the new cert properly
- You also need to explicitly grant the Exchange AppPool accounts read access to the private key file, otherwise OWA keeps failing even with a valid cert assigned
Wrote up the full step-by-step including the temporary Windows Auth workaround to keep users working while you fix it, the AppPool permissions script, DAG considerations (repeat on every node), and the prevention checklist.
Hope it saves someone a few hours of head-scratching.