0

Recently we have been experiencing an error when doing searches on our SharePoint Server 2016 intranet. I have reviewed the logs and found the following error message:

Critical    An operation failed because the following certificate has validation errors:  
Subject Name: CN=SharePoint Security Token Service, OU=SharePoint, O=Microsoft, C=US Issuer Name: 
CN=SharePoint Root Authority, OU=SharePoint, O=Microsoft, C=US Thumbprint: --thumbprint--  
Errors:   PartialChain: A certificate chain could not be built to a trusted root authority.  
RevocationStatusUnknown: The revocation function was unable to check revocation for the certificate.  
OfflineRevocation: The revocation function was unable to check revocation because the revocation server 
was offline.

I am confident that no changes were made to farm recently, and when I look in CA at the trust settings it seems like this certificate won't expire for 10,000 years. How can I correct this issue?

4
  • it seems similar but not quite the same. the local trust has not been deleted.
    – Matt
    Jun 12, 2023 at 16:19
  • Make sure that you have your SP certs installed in Certificates - Local Machine storage (certlm.msc - SharePoint - Certificates or Powershell: Get-ChildItem -Path Cert:\LocalMachine\SharePoint)
    – lehuspohus
    Jun 18, 2023 at 17:22
  • @lehuspohus Yes I see the security token service, the security token service encryption and services certs in that folder.
    – Matt
    Jun 19, 2023 at 18:48

2 Answers 2

1

Let's do some general troubleshooting:

  1. Check the certificate chain: Make sure that the SharePoint Root Authority certificate is installed on all SharePoint servers in the farm and that the SharePoint Security Token Service certificate is issued by the SharePoint Root Authority.

  2. Check the certificate revocation status: Verify that the revocation status of the SharePoint Security Token Service certificate is valid. You can do this by opening the certificate properties in the Certificate snap-in and checking the revocation status.

  3. Check the Certificate Revocation List (CRL) distribution points: Ensure that the CRL distribution points specified in the SharePoint Root Authority certificate are accessible from all SharePoint servers in the farm.

  4. Restart the SharePoint Security Token Service: Restarting the SharePoint Security Token Service may help resolve the issue. You can do this by using the Services console or by running the following PowerShell command: Restart-Service SPTimerV4

0

Ultimately there was a pending SharePoint patch of which I was unaware. I completed the installation of that patch and it appears that the Search service resumed normal operation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.