0

I have issues with my lab environment where I have set redirection from http to https. Everything works fine until I try to open documents in web apps. I am getting error that there was a problem and document cannot be opened.

Here is short overview of how I set up redirection:

  1. Added new binding in IIS for my web application (https, port 443 and certificate)
  2. AAM settings:

    a)Internal URL:https://servername, Zone:Default, Public URL:https://servername

    b)Internal URL:http://servername, Zone:Default, Public URL:https://servername

Office farm configuration:

enter image description here

WOPI zone has been set to internal-https.

Logs from OOS:

02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Office Online Collab Sandboxing buqay Medium Wopi,CheckFile,WACSERVER HttpRequestAsyncException [url:UREDACTED_(vHKPAP1SI77bjR6MgrgTYoLULPb0bcptKBENxaaj3dA=), e:Microsoft.Office.Web.Common.HttpRequestAsyncException: No Response in WebException ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult) at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar) --- End of inner exception stack trace --- at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult) at Microsoft.Office.Web.Common.HttpRequestAsync.GetResponseCallback(IAsyncResult asyncResult) --- End of inner exception stack trace ---] 9a3fbd9e-4066-604e-f675-99afa0e09b9f 02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Office Online Collab Sandboxing adhsk Unexpected WOPI CheckFile: Catch-All Failure [exception:Microsoft.Office.Web.Common.EnvironmentAdapters.UnexpectedErrorException: HttpRequest failed. ---> Microsoft.Office.Web.Common.HttpRequestAsyncException: No Response in WebException ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult) at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar) --- End of inner exception stack trace --- at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult) at Microsoft.Office.Web.Common.HttpRequestAsync.GetResponseCallback(IAsyncResult asyncResult) --- End of inner exception stack trace --- --- End of inner exception stack trace --- at Microsoft.Office.Web.Apps.Common.WopiTalky.AddHostResponseDataAndThrow(Exception exception, HttpRequestAsyncResult result) at Microsoft.Office.Web.Apps.Common.WopiTalky.LogAndThrowWireException(HttpRequestAsyncResult result, HttpRequestAsyncException delayedException) at Microsoft.Office.Web.Apps.Common.WopiDocument.LogAndThrowWireException(HttpRequestAsyncResult result, HttpRequestAsyncException delayedException) at Microsoft.Office.Web.Common.HttpRequestAsync.End() at Microsoft.Office.Web.Apps.Common.WopiDocument.CheckWopiFile()] 9a3fbd9e-4066-604e-f675-99afa0e09b9f 02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Office Online Collab Sandboxing ajjve Medium WOPI CheckFile: Catch-All Failure [url:UREDACTED_(6UnYFVPmv6zdLFtOUT4YJEYsPRvdiT0O6frvZoEsQhM=)] 9a3fbd9e-4066-604e-f675-99afa0e09b9f 02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Office Online Word Online DocX Common ann56 Medium Setting Completion: [Operation:WacCheckFile] [CompletedSuccessfully:False] [RootOperation:] [StartTime:02/06/2019 07:54:12.612] [DurationInMilliseconds:39] [SizeInBytes:0] [ExtraInfo:] 9a3fbd9e-4066-604e-f675-99afa0e09b9f 02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Services Infrastructure Services Infrastructure Br Err bsl5f Medium BaseDocument::LogSessionMetrics: {"ApplicationLCID":"pl-PL","BrowserLCID":"pl-PL","DataLCID":"en-US"} 9a3fbd9e-4066-604e-f675-99afa0e09b9f 02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Office Online Collab Sandboxing axvdb Medium CheckFailureCache.IncrementCheckFailureCount Doc: e02f7b7c23e308eeaca7d4921b409b72f6a1fc0a5f729604cb5a51af65ef2121 User: IREDACTED 9a3fbd9e-4066-604e-f675-99afa0e09b9f 02/06/2019 08:54:12.65 w3wp.exe (0x3AB4) 0x2738 Services Infrastructure Services Infrastructure Br Err b66ra Unexpected FileUnknownException with InnerException from CheckBaseDocument, InnerException: Microsoft.Office.Web.Common.EnvironmentAdapters.UnexpectedErrorException: HttpRequest failed. ---> Microsoft.Office.Web.Common.HttpRequestAsyncException: No Response in WebException ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult) at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar) --- End of inner exception stack trace --- at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult) at Microsoft.Office.Web.Common.HttpRequestAsync.GetResponseCallback(IAsyncResult asyncResult) --- End of inner exception stack trace --- --- End of inner exception stack trace --- at Microsoft.Office.Web.Apps.Common.WopiTalky.AddHostResponseDataAndThrow(Exception exception, HttpRequestAsyncResult result) at Microsoft.Office.Web.Apps.Common.WopiTalky.LogAndThrowWireException(HttpRequestAsyncResult result, HttpRequestAsyncException delayedException) at Microsoft.Office.Web.Apps.Common.WopiDocument.LogAndThrowWireException(HttpRequestAsyncResult result, HttpRequestAsyncException delayedException) at Microsoft.Office.Web.Common.HttpRequestAsync.End() at Microsoft.Office.Web.Apps.Common.WopiDocument.CheckWopiFile() 9a3fbd9e-4066-604e-f675-99afa0e09b9f

I read some articles (e.g. link) that adding http path as intranet zone may resolve issue, but in my scenario it removes redirection from http to https.

How can I configure it to make it work? I suppose that better option would be to extend my web application to SSL (I have done it for another web app and web apps work there), but I am wondering whether it is possible to perform it without creating separate site.

Thanks in advance for advice.

  • Please post your OfficeOnlineServer configuration here by running Get-OfficeWebAppsFarm on OOS-Server – MHeld Feb 5 at 14:11
  • I have updated my post – Mateusz Kuś Feb 5 at 14:21
  • Configuration looks OK. OOS has it's own ULS-Log (see LogLocation). Please post the correlation of a failed error here. – MHeld Feb 5 at 14:47
  • Correlation stack added – Mateusz Kuś Feb 6 at 14:30
0

The internal/external wopi zones are a reference to the OOS config, not your AAMs. For example, connect to:

http://yourofficeonlineserver/hosting/discovery

And check the output of the above. It should indicate how its configured (internal/external/http/https/etc.) Then, run the following on the SharePoint server to compare:

get-spwopizone get-spwopibinding

The output of all of the above needs to match.

  • Hello Mike, like I wrote, web apps work fine on another web application where I have extended it to SSL. It doesn't work in one scenario: when I am accessing it from web application where I have set bindings and AAMs to redirect me from http to https (so it works perfectly for http sites etc.) – Mateusz Kuś Feb 5 at 14:26
0

OfficeOnlineServer doesn't trust SharePoint's SSL-Certificate:

System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

As you have the issue in a lab environment, i expect you used a self-signed certificate. This isn't trusted by another machine by default. You have several solutions to get SharePoint trusted by OOS:

  • Download the Certificate and import it on OOS-Server as Trusted Root Authority. This is a little dirty, but makes least work.
  • Deploy an own Certification Authority (CA) in your Lab-Environment and issue a SSL-Certificate there. If all machines are joined to the same domain, they will trust all certificates issues by your CA.
  • Buy an 'official' certificate from a company like Digicert, Comodo, ...
  • I decided to extend web application to SSL. When I access sites using both protocols (without URL rewrite redirection) everything works fine and I am able to open documents in browser on both protocols. Once I enable rewrite rule web apps stop working (even after adding Sharepoint cert to the trusted authorities on OOS server). I cannot comprehend this. Do you have any other suggestions? – Mateusz Kuś Feb 6 at 15:48
  • What do you mean with enable rewrite rule? Did you implement IIS-Rewrite module? I also see some discrepancy between your original post (the not-extended-site doesn't work) vs. your comment (extended-site with rewrite doesn't work). – MHeld Feb 6 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.