How To: Update the Signing Certificate Used with OWA

Version Affected: All

 

Overview

This article explains how to replace the certificate a SecureAuth realm uses to sign requests to Outlook Web App (OWA) — for example, when the current certificate is expiring.

Update the Signing Certificate

1. On the SecureAuth Identity Provider (IdP) appliance, install the new certificate into the Local Computer's Personal certificate store.
2. Right-click the certificate, select All Tasks > Manage Private Keys, and grant Authenticated Users and Network Service at least Read permission.
3. In IIS Manager, select the Default Web Site, open Bindings, edit the port 443 binding, and select the new certificate.
4. In the SecureAuth Admin Console, open the OWA realm's Post Auth tab, select the new certificate as the Signing Cert, and click Save.
5. Get the new certificate's thumbprint: open the certificate, go to the Details tab, scroll to Thumbprint, and copy the value into Notepad. Remove all spaces from the value and change every letter to uppercase.
6. On the Exchange server, open C:\Program Files\Microsoft\Exchange Server\V15\Frontend\HttpProxy\Owa\web.config and update its thumbprint entry to: <add thumbprint="YOURCERTTHUMBPRINTHERE" name="https://secureauth.companyname.com/SecureAuthrealm/" />, replacing YOURCERTTHUMBPRINTHERE with the thumbprint from step 5.
7. Repeat step 6 for C:\Program Files\Microsoft\Exchange Server\V15\Frontend\HttpProxy\ecp\web.config.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.