On our SharePoint 2010 farm we renewed our SSL certificate, and after renewal we started to get following error in Event Log

 Event ID 8311
An operation failed because the following certificate has validation errors:\n\nSubject Name: CN=SharePoint Security Token Service, OU=SharePoint, O=Microsoft, C=US\nIssuer Name: CN=SharePoint Root Authority, OU=SharePoint, O=Microsoft, C=US\nThumbprint: DFA88D35F5B27CECF83A06AB9E0F31D4B324C634\n\nErrors:\n\n RevocationStatusUnknown: The revocation function was unable to check revocation for the certificate.

Website is generally working with correct renewed certificate. Even Claims Authentication between SharePoint and custom security app is also working. But some of the SharePoint services are giving serious issues like search is not working and giving following error:

The requested service, 'http://server:32843/f6a9024b8bbe48ebae7e9ffc8f5809dd/SearchService.svc' could not be activated. See the server's diagnostic trace logs for more information.
Stack trace: 
Server stack trace: 
at System.ServiceModel.Channels.HttpChannelUtilities.ValidateRequestReplyResponse(HttpWebRequest request, HttpWebResponse response, HttpChannelFactory factory, WebException responseException, ChannelBinding channelBinding)

When I run Get-SPSite command in powershell I get following error

Get-SPSite : ID4257: X.509 certificate 'CN=SharePoint Security Token Service, OU=SharePoint, O=Microsoft, C=US' validation failed by the token handler.

I am not able to deactivate/activate any features on the server, it throws certificate error.

I have already tried following:

 1. Recreating the local trust relationship using following commands
    $rootCert = (Get-SPCertificateAuthority).RootCertificate
    New-SPTrustedRootAuthority -Name "localNew" -Certificate $rootCert

2. Adding "SharePoint Root Authority" certificate to certificate store on each server in the farm, in mmc SharePoint certificates "SharePoint Security Token Service"  certificate is displayed under "SharePoint Root Authority" certificate.

3 Answers 3


The last commands did solve this in my case, I also had to run an IISRESET on all serverns in the farm

More information http://support.microsoft.com/kb/2545744


We ran into this issue while using a WildCard Cert. The Name of the Cert in the Trusted Store MUST match the Friendly name of the Certificate. Also, make sure you do not have the same certificate in the store under different names.

Just passing along some of the findings we encountered in 2013.


We came across a similar problem on our UAT Farm. On investigating we found the certificate was expired. We followed the article https://technet.microsoft.com/en-us/library/dn551378.aspx to the letter and the problem was resolved.

Once you have followed the article, the securitytoken service URL: http://localhost:32843/SecurityTokenServiceApplication/securitytoken.svc should not give you / server errors.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.