Certificate trust validation failed

Question

Certificate trust validation failed

Rodrigo Rocha 96

After running the Microsoft Remote Connectivity Analyzer, we received a connectivity test fail while testing the certificate:

Testing the SSL certificate to make sure it's valid.

The SSL certificate failed one or more certificate validation checks.

    Certificate trust is being validated.

       Certificate trust validation failed.

The Microsoft Connectivity Analyzer is attempting to build certificate chains for certificate CN=...

A certificate chain couldn't be constructed for the certificate.

Additional Details

  The certificate chain has errors. Chain status = NotTimeValid.

Any idea on how to fix this?

Manu Philip 20,491 Reputation points MVP Volunteer Moderator

2020-06-03T19:03:06.597+00:00

Hello,
Is that certificate expired?

Thanks,
Manu

Answer accepted by question author

0 additional answers

Your answer

Manu Philip 20,491 Reputation points MVP Volunteer Moderator

2020-06-03T19:03:06.597+00:00

Hello,
Is that certificate expired?

Thanks,
Manu

Answer 1

Rodrigo Rocha 96

We had a certificate expire a few months ago, and we replaced it on the ad fs servers.

The one we are using right now should be valid until 2022.

Is is possible the Exchange online is still using the old one?

Manu Philip 20,491 Reputation points MVP Volunteer Moderator

2020-06-03T19:31:31.28+00:00

Hi,
Please check Using Powershell

Get-MsolFederationProperty -DomainName "your domain name"

If it shows expired certificate, you can update it as follows:

Update-MsolFederatedDomain –DomainName "your domain name"

And check again with the first cmdlet

Please mark as "Accept the answer" if the above steps helps you. Others with similar issues can also follow the solution as per your suggestion

Regards,

Manu
Rodrigo Rocha 96 Reputation points

2020-06-03T20:03:09.047+00:00

Hello again Manu, thanks for your reply!

after executing the command on our server, the certificate it shows us seems to be valid.

J will attach the result here, without the domain9005-powershell.txt

was the result corret?

Thanks for the help so far.

Rodrigo
Manu Philip 20,491 Reputation points MVP Volunteer Moderator

2020-06-03T20:27:23.53+00:00
Hello Rodrigo,

Thanks for providing more details. Looks like you need to update the new certificate for service connections
Following steps should resolve the issue

Get the thumbprint of the new certificate

Open PowerShell as ADFS service account (Shift right click in PowerShell shortcut and select Run as different user)

Add-PsSnapin Microsoft.Adfs.PowerShell

Set-AdfsCertificate -CertificateType "Service-Communications" -Thumbprint "thumbprint copied in first step"

Please mark as "Accept the answer" if the above steps helps you. Others with similar issues can also follow the solution as per your suggestion

Regards,

Manu
Rodrigo Rocha 96 Reputation points

2020-06-05T19:42:35.577+00:00

Hello!

That, along with your first command. fixed the problem we were having.

we still got the error on the conectivity analyzer, but our users can now log onto the outlook 365

Thanks for the help!

Share via

Certificate trust validation failed

0 additional answers

Your answer