Federation trust validation after certificate renewal

Question

Federation trust validation after certificate renewal

Rakesh Sharma 20

In our hybrid Exchange setup, calendar free/busy lookups between two forests stopped working right after a certificate renewal. Before the renewal, cross‑forest availability requests were fine, but now users can’t see each other’s schedules

0 comments

1 answer

Your answer

Answer 1

Hi @Rakesh Sharma

Based on the information provided, I understand that cross-forest calendar free/busy lookups were working before the certificate renewal, but stopped immediately afterward in your hybrid Exchange environment.

In this case, I would first verify the free/busy authentication path being used, either Organization Relationship/Federation, IntraOrganizationConnector/OAuth, or Availability Address Space. Since the issue started after certificate renewal, a common cause is stale federation metadata or an updated Auth/Federation certificate that has not been refreshed in the relevant trust path.

Please try refreshing the federation trust metadata from Exchange Management Shell:

Get-FederationTrust | Set-FederationTrust -RefreshMetadata
Get-FederationTrust | Set-FederationTrust -RefreshMetadata

Then verify Autodiscover and EWS virtual directory authentication and URLs:

Get-AutodiscoverVirtualDirectory | FL Server,ExternalUrl,*Authentication*
Get-WebServicesVirtualDirectory | FL Server,ExternalUrl,*Authentication*

If the environment uses OAuth/IntraOrganizationConnector, also test OAuth connectivity and confirm that the renewed Exchange Auth certificate is updated in the hybrid configuration/dedicated Exchange hybrid app path:

Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com/ews/exchange.asmx -Mailbox ******@domain.com -Verbose | FL

I would also recommend running the Hybrid Free Busy Checker, as Microsoft recommends it for validating the current hybrid availability configuration. If the error includes “verifying security for the message,” reset WSSecurity on Autodiscover and EWS and restart IIS on the Exchange servers. Microsoft documents that this error can occur after federation certificate renewal.

If you paste the exact Test-OrganizationRelationship, Test-OAuthConnectivity, or free/busy error text, I can help map it to the most likely failing component.

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click ""Comment"".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.