[SP2016][Office Online Server] Web Apps don't work on SharePoint https sites

Question

I have issues with my lab environment where I have set redirection from http to https. Everything works fine until I try to open documents in web apps. I am getting error that there was a problem and document cannot be opened.

Here is short overview of how I set up redirection:

1. Added new binding in IIS for my web application (https, port 443 and certificate)

2. AAM settings:

   a)Internal URL:https://servername, Zone:Default, Public URL:https://servername

   b)Internal URL:http://servername, Zone:Default, Public URL:https://servername

Office farm configuration:

WOPI zone has been set to internal-https.

Logs from OOS:

02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Office Online Collab Sandboxing buqay Medium Wopi,CheckFile,WACSERVER HttpRequestAsyncException [url:UREDACTED_(vHKPAP1SI77bjR6MgrgTYoLULPb0bcptKBENxaaj3dA=), e:Microsoft.Office.Web.Common.HttpRequestAsyncException: No Response in WebException ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult) at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar) --- End of inner exception stack trace --- at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult) at Microsoft.Office.Web.Common.HttpRequestAsync.GetResponseCallback(IAsyncResult asyncResult) --- End of inner exception stack trace ---] 9a3fbd9e-4066-604e-f675-99afa0e09b9f 02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Office Online Collab Sandboxing adhsk Unexpected WOPI CheckFile: Catch-All Failure [exception:Microsoft.Office.Web.Common.EnvironmentAdapters.UnexpectedErrorException: HttpRequest failed. ---> Microsoft.Office.Web.Common.HttpRequestAsyncException: No Response in WebException ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult) at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar) --- End of inner exception stack trace --- at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult) at Microsoft.Office.Web.Common.HttpRequestAsync.GetResponseCallback(IAsyncResult asyncResult) --- End of inner exception stack trace --- --- End of inner exception stack trace --- at Microsoft.Office.Web.Apps.Common.WopiTalky.AddHostResponseDataAndThrow(Exception exception, HttpRequestAsyncResult result) at Microsoft.Office.Web.Apps.Common.WopiTalky.LogAndThrowWireException(HttpRequestAsyncResult result, HttpRequestAsyncException delayedException) at Microsoft.Office.Web.Apps.Common.WopiDocument.LogAndThrowWireException(HttpRequestAsyncResult result, HttpRequestAsyncException delayedException) at Microsoft.Office.Web.Common.HttpRequestAsync.End() at Microsoft.Office.Web.Apps.Common.WopiDocument.CheckWopiFile()] 9a3fbd9e-4066-604e-f675-99afa0e09b9f 02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Office Online Collab Sandboxing ajjve Medium WOPI CheckFile: Catch-All Failure [url:UREDACTED_(6UnYFVPmv6zdLFtOUT4YJEYsPRvdiT0O6frvZoEsQhM=)] 9a3fbd9e-4066-604e-f675-99afa0e09b9f 02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Office Online Word Online DocX Common ann56 Medium Setting Completion: [Operation:WacCheckFile] [CompletedSuccessfully:False] [RootOperation:] [StartTime:02/06/2019 07:54:12.612] [DurationInMilliseconds:39] [SizeInBytes:0] [ExtraInfo:] 9a3fbd9e-4066-604e-f675-99afa0e09b9f 02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Services Infrastructure Services Infrastructure Br Err bsl5f Medium BaseDocument::LogSessionMetrics: {"ApplicationLCID":"pl-PL","BrowserLCID":"pl-PL","DataLCID":"en-US"} 9a3fbd9e-4066-604e-f675-99afa0e09b9f 02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Office Online Collab Sandboxing axvdb Medium CheckFailureCache.IncrementCheckFailureCount Doc: e02f7b7c23e308eeaca7d4921b409b72f6a1fc0a5f729604cb5a51af65ef2121 User: IREDACTED 9a3fbd9e-4066-604e-f675-99afa0e09b9f 02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Services Infrastructure Services Infrastructure Br Err b66ra Unexpected FileUnknownException with InnerException from CheckBaseDocument, InnerException: Microsoft.Office.Web.Common.EnvironmentAdapters.UnexpectedErrorException: HttpRequest failed. ---> Microsoft.Office.Web.Common.HttpRequestAsyncException: No Response in WebException ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult) at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar) --- End of inner exception stack trace --- at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult) at Microsoft.Office.Web.Common.HttpRequestAsync.GetResponseCallback(IAsyncResult asyncResult) --- End of inner exception stack trace --- --- End of inner exception stack trace --- at Microsoft.Office.Web.Apps.Common.WopiTalky.AddHostResponseDataAndThrow(Exception exception, HttpRequestAsyncResult result) at Microsoft.Office.Web.Apps.Common.WopiTalky.LogAndThrowWireException(HttpRequestAsyncResult result, HttpRequestAsyncException delayedException) at Microsoft.Office.Web.Apps.Common.WopiDocument.LogAndThrowWireException(HttpRequestAsyncResult result, HttpRequestAsyncException delayedException) at Microsoft.Office.Web.Common.HttpRequestAsync.End() at Microsoft.Office.Web.Apps.Common.WopiDocument.CheckWopiFile() 9a3fbd9e-4066-604e-f675-99afa0e09b9f

I read some articles (e.g. link) that adding http path as intranet zone may resolve issue, but in my scenario it removes redirection from http to https.

How can I configure it to make it work? I suppose that better option would be to extend my web application to SSL (I have done it for another web app and web apps work there), but I am wondering whether it is possible to perform it without creating separate site.

Thanks in advance for advice.

Answer 1

The internal/external wopi zones are a reference to the OOS config, not your AAMs. For example, connect to:

http://yourofficeonlineserver/hosting/discovery

And check the output of the above. It should indicate how its configured (internal/external/http/https/etc.) Then, run the following on the SharePoint server to compare:

get-spwopizone get-spwopibinding

The output of all of the above needs to match.

Answer 2

OfficeOnlineServer doesn't trust SharePoint's SSL-Certificate:

System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

As you have the issue in a lab environment, i expect you used a self-signed certificate. This isn't trusted by another machine by default. You have several solutions to get SharePoint trusted by OOS:

• Download the Certificate and import it on OOS-Server as Trusted Root Authority. This is a little dirty, but makes least work.
• Deploy an own Certification Authority (CA) in your Lab-Environment and issue a SSL-Certificate there. If all machines are joined to the same domain, they will trust all certificates issues by your CA.
• Buy an 'official' certificate from a company like Digicert, Comodo, ...