Return
-
Title
Error The certificate is invalid 'CN=outlook.domain.com, OU=OUname, O=Contoso, L=Halifax, S=NS, C=CA', there is error 'PartialChain' in the certificate chain -
Description
During mail sync the MAgE logs various certificate errors, like:
2017-08-28 19:44:26.4233 Px968 Tx46 A1 C1 M2 Error The certificate is invalid 'CN=outlook.domain.com, OU=OUname, O=Contoso, L=Halifax, S=NS, C=CA', there is error 'PartialChain' in the certificate chain.
2017-08-28 19:44:26.4143 Px968 Tx46 A1 C1 M2 Error Microsoft.Exchange.WebServices.Data.ServiceRequestException: The request failed. The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. | at
[inner] System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. | at System.Net.HttpWebRequest.GetResponse()at Microsoft.Exchange.WebServices.Data.EwsHttpWebRequest.Microsoft.Exchange.WebServices.Data.IEwsHttpWebRequest.GetResponse()at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverRequest.InternalExecute()[inner] System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. | at System.Net.Security.SslState.StartSendAuthResetSignal(Protocoor2020-06-15 14:38:55.9861 PxF1C Tx28 A6 C1 M152 Error The certificate is invalid 'CN=outlook.domain.com, OU=OUname, O=Contoso, L=Halifax, S=NS, C=CA', there is error 'UntrustedRoot' in the certificate chain....2020-06-15 14:38:55.9861 PxF1C Tx28 A6 C1 M152 Error MigrationManagerForExchange.Shared.Heart.RootFolderBindException: Can not bind to the root folder | at MigrationManager.Exchange.MigrationConnectors.Ews.EwsSyncConnector.Connect()at MigrationManager.Exchange.MigrationConnectors.GenericSyncConnector.StartSync(SyncDirection syncType)at MigrationManager.Exchange.MigrationConnectors.GenericSyncConnector.ReSync(SyncDirection syncType)at MigrationManager.Exchange.Agent.Jobs.DisPlusO365JobBase.<>c__DisplayClass105_0.<DoSync>b__3()at MigrationManagerForExchange.General.DotNet.ResultHandler.Execute(Action act, Action onSuccess, Action`1 onFailure, Boolean bSuppressException)at MigrationManager.Exchange.Agent.Jobs.DisPlusO365JobBase.DoSync(IMailboxSyncConnectorInternal sourceConnector, IMailboxSyncConnectorInternal targetConnector, String mailboxLedn, IAgentProperties cfg)at MigrationManager.Exchange.Agent.Jobs.DisBaseJob.PerformSync()at MigrationManager.Exchange.Agent.Jobs.DisPlusO365JobBase.RunJob()[inner] Microsoft.Exchange.WebServices.Data.ServiceRequestException: The request failed. The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. | at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverRequest.InternalExecute()at Microsoft.Exchange.WebServices.Autodiscover.GetUserSettingsRequest.Execute()at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.InternalGetUserSettings(List`1 smtpAddresses, List`1 settings, Nullable`1 requestedVersion, Uri& autodiscoverUrl)at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.GetSettings[TGetSettingsResponseCollection,TSettingName](List`1 identities, List`1 settings, Nullable`1 requestedVersion, GetSettingsMethod`2 getSettingsMethod, Func`1 getDomainMethod)at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.GetUserSettings(List`1 smtpAddresses, List`1 settings)at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.InternalGetSoapUserSettings(String smtpAddress, List`1 requestedSettings)at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.GetUserSettings(String userSmtpAddress, UserSettingName[] userSettingNames)at MMEx.General.Autodiscover.ExchangeAutodiscoverService.GetUserSettings(String userSmtpAddress, UserSettingName[] userSettingNames)at MMEx.General.Autodiscover.Autodiscover.GetUserSettings(String emailAddress, NetworkCredential creds, Uri& autodiscoverUrl, Boolean enableScpLookup, Nullable`1& isExternal, AutodiscoverUserSetting[] userSettingNames)at MMEx.General.Autodiscover.Autodiscover.GetEwsUrl(String emailAddress, NetworkCredential creds, Uri& autodiscoverUrl, Boolean enableScpLookup)at MigrationManager.Exchange.MigrationConnectors.Ews.EwsSessionCreator.DiscoverUrl()at MigrationManager.Exchange.MigrationConnectors.Ews.EwsSessionCreator.get_Url()at MigrationManager.Exchange.MigrationConnectors.Ews.EwsSessionCreator.GetExchangeDllServiceParameters()at MigrationManager.Exchange.MigrationConnectors.Ews.EwsSessionCreator.GetExchangeService()at MigrationManager.Exchange.MigrationConnectors.Ews.EwsSyncConnector.get_Exs()at MigrationManager.Exchange.MigrationConnectors.Ews.EwsSyncConnector.ConnectInternal()at MigrationManager.Exchange.MigrationConnectors.Ews.EwsSyncConnector.ReconnectOverAutodiscover()at MigrationManager.Exchange.MigrationConnectors.Ews.EwsSyncConnector.Connect()[inner] System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. | at System.Net.HttpWebRequest.GetResponse()at Microsoft.Exchange.WebServices.Data.EwsHttpWebRequest.Microsoft.Exchange.WebServices.Data.IEwsHttpWebRequest.GetResponse()at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverRequest.InternalExecute()[inner] System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. | at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)at System.Net.TlsStream.CallProcessAuthentication(Object state)at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)at System.Net.PooledStream.Write(Byte[] buffer, Int32 offset, Int32 size)at System.Net.ConnectStream.WriteHeaders(Boolean async) -
Cause
This error usually occurs during initial setup if the noted certificate chain has not been imported into the Trusted Root Certification Authorities on the MAgE agent host machine and QMM console machine. -
Resolution
To resolve this issue, export the certificate chain for the noted domain in the error message into the Trusted Root Certification Authorities on the MAgE agent host machines and QMM console machine using the Certificates Snap-In.
If MAGE host server is associated with Exchange 2016 or later it is sometimes useful to use AutoDiscover/healthcheck.htm web page, like in https://autodiscover.contoso.com/autodiscover/healthcheck.htm, by running a similar URL in Internet Explorer or any other browser on the MAGE host server and / or MMEX console machine.
The healthcheck.htm web page is dynamically generated by Exchange and can be used for troubleshooting any virtual directories, like OAB, OWA, EWS, AutoDiscover, etc. When a workload is healthy, the URL returns 200 OK code. If any essencial certificates are missing the page prompts to donwload missing certificates.