0

One day ago my dev ShP environment stopped working, showing 500 Internal Server Error.

After analyzing the ULS logs the following error is found:

11/13/2017 16:11:42.38 w3wp.exe (0x0C30) 0x1C1C SharePoint Foundation Monitoring nasq Medium Entering monitored scope (Request (GET:https://XXXXconfluence.XXXXX.com:443/_layouts/15/settings.aspx)). Parent No
11/13/2017 16:11:42.40 w3wp.exe (0x0C30) 0x1C1C SharePoint Foundation Logging Correlation Data xmnv Medium Name=Request (GET:https://XXXXconfluence.XXXXX.com:443/_layouts/15/settings.aspx) ea7a2c9e-2403-5080-80b3-b213b527ed4e 11/13/2017 16:11:42.49 w3wp.exe (0x0C30) 0x1C1C SharePoint Foundation Topology aeayb Medium SecurityTokenServiceSendRequest: RemoteAddress: 'http://localhost:32843/SecurityTokenServiceApplication/securitytoken.svc' Channel: 'Microsoft.IdentityModel.Protocols.WSTrust.IWSTrustChannelContract' Action: 'http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue' MessageId: 'urn:uuid:7b117fc0-86d3-4234-8762-dbc3c0f0ceb7' ea7a2c9e-2403-5080-80b3-b213b527ed4e 11/13/2017 16:11:42.54 w3wp.exe (0x16E0) 0x1738 SharePoint Foundation Topology aeax9 Medium SecurityTokenServiceReceiveRequest: LocalAddress: 'http://XXXX102f0f.XXXXX.com:32843/SecurityTokenServiceApplication/securitytoken.svc' Channel: 'System.ServiceModel.Channels.ServiceChannel' Action: 'http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue' MessageId: 'urn:uuid:7b117fc0-86d3-4234-8762-dbc3c0f0ceb7' ea7a2c9e-2403-5080-80b3-b213b527ed4e 11/13/2017 16:11:42.54 w3wp.exe (0x16E0) 0x1738 SharePoint Foundation Monitoring nasq Medium Entering monitored scope (ExecuteSecurityTokenServiceOperationServer). Parent No ea7a2c9e-2403-5080-80b3-b213b527ed4e 11/13/2017 16:11:42.66 w3wp.exe (0x16E0) 0x1738 SharePoint Foundation Claims Authentication af3y9 Medium STS Call Claims Windows: Successfully requested sign-in claim identity for user 'XXXXX\Sergey_Solovyev'. ea7a2c9e-2403-5080-80b3-b213b527ed4e 11/13/2017 16:11:43.57 w3wp.exe (0x0C30) 0x1C1C SharePoint Foundation Monitoring b4ly High Leaving Monitored Scope (SPClaimsCounterScope). Execution Time=1138.70987793141 ea7a2c9e-2403-5080-80b3-b213b527ed4e 11/13/2017 16:11:43.58 w3wp.exe (0x0C30) 0x1C1C SharePoint Foundation General 8nca Medium Application error when access /_layouts/15/settings.aspx, Error=NotTimeValid: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. at Microsoft.SharePoint.SPCertificateValidator.SPImmutableCertificateValidator.Validate(X509Certificate2 certificate) at Microsoft.SharePoint.SPCertificateValidator.Validate(X509Certificate2 certificate) at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token) ea7a2c9e-2403-5080-80b3-b213b527ed4e 11/13/2017 16:11:43.60 w3wp.exe (0x0C30) 0x1C1C SharePoint Foundation Runtime tkau Unexpected System.IdentityModel.Tokens.SecurityTokenValidationException: NotTimeValid: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. at Microsoft.SharePoint.SPCertificateValidator.SPImmutableCertificateValidator.Validate(X509Certificate2 certificate) at Microsoft.SharePoint.SPCertificateValidator.Validate(X509Certificate2 certificate) at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token) ea7a2c9e-2403-5080-80b3-b213b527ed4e 11/13/2017 16:11:43.61 w3wp.exe (0x0C30) 0x1C1C SharePoint Foundation General ajlz0 High Getting Error Message for Exception System.IdentityModel.Tokens.SecurityTokenValidationException: ID4257: X.509 certificate '[email protected], CN=XXXXoqa.XXXXX.com, O=XXXXX, L=XXXX, S=XXXXX, C=US' validation failed by the token handler. ---> System.IdentityModel.Tokens.SecurityTokenValidationException: NotTimeValid: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. at Microsoft.SharePoint.SPCertificateValidator.SPImmutableCertificateValidator.Validate(X509Certificate2 certificate) at Microsoft.SharePoint.SPCertificateValidator.Validate(X509Certificate2 certificate) at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token) --- End of inner exception stack trace --- at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token) at Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection.ValidateToken(SecurityToken token) at Microsoft.SharePoint.IdentityModel.SPFederationAuthenticationModule.AuthenticateUser(SecurityToken securityToken) at Microsoft.SharePoint.IdentityModel.SPFederationAuthenticationModule.SetPrincipalAndWriteSessionTokenWithOptions(SecurityToken securityToken, SPSessionTokenWriteType writeOperationType) at Microsoft.SharePoint.IdentityModel.SPWindowsClaimsAuthenticationHttpModule.<>c__DisplayClass5.<PerformClaimsAuthenticationForUser>b__1() at Microsoft.SharePoint.Utilities.SecurityContext.RunAsProcess(CodeToRunElevated secureCode) at Microsoft.SharePoint.IdentityModel.SPWindowsClaimsAuthenticationHttpModule.PerformClaimsAuthenticationForUser(HttpContext context, SPFederationAuthenticationModule fam, SessionAuthenticationModule sam, WindowsIdentity windowsIdentity, SessionSecurityToken sessionSecurityToken, Boolean writeCookie) at Microsoft.SharePoint.IdentityModel.SPWindowsClaimsAuthenticationHttpModule.AuthenticateRequest(Object sender, EventArgs e) at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) ea7a2c9e-2403-5080-80b3-b213b527ed4e

Event Viewer shows the same:

`An operation failed because the following certificate has validation errors:

Subject Name: [email protected], CN=XXXXqa.epam.com, O=XXXXX, L=XXXX, S=XXXX, C=US Issuer Name: CN=XXXX, DC=XXXXX, DC=com Thumbprint: 1588C8FDE0D6C31275EE16D96A9ED7173F29EFE7

Errors:

NotTimeValid: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. .`

enter image description here

I have replaced all certificates to new ones (within the validity period), cleared certificate cache, modified IIS bindings for each website using the newly installed certificates.

Using PowerShell I've found that the certificate with the thumbprint above (1588C8FDE0D6C31275EE16D96A9ED7173F29EFE7) is located in Certificate::LocalMachine\SharePoint as shown here: cert_found

Removing this certificate, performing iisreset as well as computer restart doesn't help - it magically appears here again.

Really don't know how to deal with this error so any help will be greatly appreciated!

Improve this question
4
  • are you seeing the new certificate in the store?
    – Waqas Sarwar MVP ♦
    Commented Nov 13, 2017 at 18:38
  • Yes, indeed. @via certmgr.msc
    – Sergey
    Commented Nov 13, 2017 at 20:53
  • the reason, i am asking is because if you already bind the new Cert to IIS (your web application) then this error should not block you. So make sure New cert is bind to IIS and also check in pwoershell if you are getting it there as well
    – Waqas Sarwar MVP ♦
    Commented Nov 13, 2017 at 21:06
  • As I've said before, all is mapped (and in IIS too). However the errors in ULS logs persist.
    – Sergey
    Commented Nov 13, 2017 at 22:11

2 Answers 2

Reset to default
0

There are couple of places you have to check:

  • Check the if the Certificate added into the central admin, Central Admin > Security > manage trust, if old cert is still here delete it.
  • Also check from the IIS, if that certificate bind to any other IIS site.
  • Also remove from the IIS Server, Click on Server Name in IIS > middle pane click on Server Certificates...Make sure old certificate is not present here.
  • Also check following folders from Certificate store(via MMC), Personal, Trusted certification authority and SharePoint. You can also do a search from top level and look for your old cert.
Improve this answer
2
  • Hi, thanks but as I've said earlier, certificate was found in SharePoint cert store of Local Computer, successfully deleted, host restarted and after restart appeared again in previous location, preventing sites from loading and pulling the same error into ULS logs. Any ideas regarding the current situation? Pls bear in mind that IIS bindings, certificate install and so on was completed of course.
    – Sergey
    Commented Nov 14, 2017 at 19:05
  • I read and understand the your question, but the issue their is something still exist in the environment which is causing the issue. I would have a 2nd eye to make sure it is deleted from all the places.
    – Waqas Sarwar MVP ♦
    Commented Nov 14, 2017 at 20:35
0

The root cause was wrong STS token signing certificate.
Replacing it with a new (correct) one solved the issue.
Unfortunately, I had apparently rebooted the server without saving the POSH scripts, so steps should be:

  • check STS config for certificates
  • check the certificate store for such certificates
  • replace the token signing certificate with a new one (self-signed or previously extracted from the server)
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.