We are having SharePoint 2016 (SP16) & Office Online Server (OOS) behind a reverse proxy (ARR) on-premises and offloaded SSL (ssl certificate installed on the reverse proxy only).
However, when users open files from SP16, there are 2 problems:

  1. Warning: "Only secure content is displayed" > have to click "Show all content".
  2. Subsequent requests sending from clients to oos.myexternal.com (proxy) are in both types HTTP & HTTPS instead of only HTTPS.

Please help to advise if anything wrong from the following details or additional configuration required on the proxy. Thanks.

InternalURL : http://oos.myinternal.com/
ExternalURL : https://oos.myexternal.com/
AllowHTTP : True
AllowOutboundHttp : False
SSLOffloaded : True

SP16 Binding:
ServerName : OOS.myinternal.COM
WopiZone : external-http

*Notes: Understanding the offloading poses an insecure issue but mine's just a shared environment without any sensitive content, also the connections among the proxy & other servers are private. Just want to know configuration to make it work, pls don't discuss the security topic here. Thanks.

1 Answer 1


Never, ever offload SSL. This creates an insecure environment passing tokens that are as good as a username and password between SharePoint and OOS. These can be intercepted and replayed.

But you have a mismatch between your WOPI zone on SharePoint and your ExternalUrl on OOS.

  • Thank Trevor for your advice. I've just updated question regarding the security concern. I tried to bind wopi zone to external-https but it's not working also. Appreciate if you can advise what is the correct binding to make it work.
    – Lucio
    Dec 5, 2019 at 4:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.