0

On our SharePoint 2010 farm we renewed our SSL certificate, and after renewal we started to get following error in Event Log

Event ID 8311
An operation failed because the following certificate has validation errors:\n\nSubject Name:
  CN=SharePoint Security Token Service, OU=SharePoint, O=Microsoft, C=US\nIssuer Name: CN=SharePoint Root Authority, OU=SharePoint, O=Microsoft, C=US\nThumbprint: \n\nErrors:\n\n

RevocationStatusUnknown: The revocation function was unable to check revocation for the certificate.

Website is generally working with correct renewed certificate. Even Claims Authentication between SharePoint and custom security app is also working. But some of the SharePoint services are giving serious issues like search is not working and giving following error:

The requested service, 'http://server:32843/f6a9024b8bbe48ebae7e9ffc8f5809dd/SearchService.svc' could not be activated. See the server's diagnostic trace logs for more information.
Stack trace: 
Server stack trace: 
at System.ServiceModel.Channels.HttpChannelUtilities.ValidateRequestReplyResponse(HttpWebRequest request, HttpWebResponse response, HttpChannelFactory factory, WebException responseException, ChannelBinding channelBinding)

When I run Get-SPSite command in powershell I get following error

Get-SPSite : ID4257: X.509 certificate 'CN=SharePoint Security Token Service, OU=SharePoint, O=Microsoft, C=US' validation failed by the token handler.

I am not able to deactivate/activate any features on the server, it throws certificate error.

I have already tried following:

1. Recreating the local trust relationship using following commands
    $rootCert = (Get-SPCertificateAuthority).RootCertificate
    New-SPTrustedRootAuthority -Name "localNew" -Certificate $rootCert

2. Adding "SharePoint Root Authority" certificate to certificate store on each server in the farm, in mmc SharePoint certificates "SharePoint Security Token Service"  certificate is displayed under "SharePoint Root Authority" certificate.
KayEye
  • 23
  • 5
  • Did you find a solution for this? Even i am having this issue on my sharepoint boxes. – kdurga Jan 14 '15 at 11:27
  • @kdurga No solution found yet. I have a support ticket open with Microsoft, I will post any findings here whenever there are any updates on it. have you tried solutions in the article http://support.microsoft.com/kb/2545744 and http://blogs.msdn.com/b/kaushal/archive/2012/10/15/disable-client-certificate-revocation-check-on-iis.aspx?wwparam=1419439265 and http://blogs.msdn.com/b/chaun/archive/2014/05/01/best-practices-for-crl-checking-on-sharepoint-servers.aspx commonly this issue is resolved by one of the methods mentioned in above posts. Let me know if any of this helped you. – KayEye Jan 14 '15 at 16:21
  • The `New-SPTrustedRootAuthority` works for me but I have to run an `iisreset` on all boxes in the farm – Eric Herlitz Mar 04 '15 at 15:41

1 Answers1

0

I had a similar issue, our symptom was

<EventID>8311</EventID>
...
<Data Name="string3">NotTimeValid: Unknown error.</Data>

the root cause was that the site was surfacing SSRS (on the same host) and it was the SSRS (which has a different binding engine to IIS) certificate had expired, but was being logged by SharePoint.

Jules Clements
  • 418
  • 5
  • 8