How to Configure CBA for exchange 2019 on premise??

Question

Good day,

I was setting up CBA for active sync and owa on exchange on premise 2019 following this guide https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/configure-certificate-based-auth?view=exchserver-2019 on my test environment.

Everything went smoothly, but when I Check OWA or ActiveSync virtual directory to require client certificate and connect through browser and prompt to choose user certificate I get error 403 "You don't have the user rights to view this page." Without virtual directory set to requiring client certificate everything works great.

Here is log of 403 in IIS: 2025-01-15 09:15:24 ::1 GET /OWA/auth.owa &encoding=; 443 - ::1 AMProbe/Local/ClientAccess - 403 7 5 19.

For CA I am using AD CA installed on domain controller, and for certificates issuance to user I use copy of user template and autoenrollment. User certificate picture is attached.

Server certificate is generated on offline Linux server CA, and this CA is trusted on domain. I really have no idea what else to do to make CBA work, maybe somebody can give some more suggestions??? certif.PNG

Answer 1

Could be a cert trust issue:

https://stackoverflow.com/questions/26247462/http-error-403-16-client-certificate-trust-issue

Answer 2

Hi @Evald Gruzdev ,

Welcome to the Microsoft Q&A platform!

Based on your description, you have completed many settings correctly, but the 403 error indicates that there may be a problem with the client certificate authentication configuration. There are several things you can check and try:

1. Make sure that the client certificate is correctly mapped to the user account in Active Directory. The certificate must contain the User Principal Name (UPN) in the Subject or Subject Alternative Name field.
2. Verify that all servers and devices involved in accessing OWA and ActiveSync trust the entire trust chain of the client certificate, including the root certificate and any intermediate CAs.
3. Double-check the IIS settings for the OWA and ActiveSync virtual directories. Make sure SSL is enabled and that the Client Certificate Mapping authentication feature is correctly installed and configured.
4. Make sure that the user account has the required permissions to access the OWA and ActiveSync virtual directories. Sometimes, certificate-based authentication may require specific permissions.
5. Make sure that the client certificate is valid and has not expired. In addition, check that the certificate is correctly issued for client authentication.

Refer to: https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/configure-certificate-based-auth?view=exchserver-2019

---

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang

Answer 3

Update. I increased uploadReadAheadSize value to 49152 for owa, ecp and activesync, and started getting error on browser “too many redirects, try clearing cookies”. Clearing cookies didn’t help (private windows also didn’t help), but then I installed another browser (chrome), and owa started working accepting certificates. The browser that I was experimenting with before (edge) still not working for owa, I guess something needs to be cleaned. I understand it is not specifically edge problem, but the fact that edge has cashed some data (since I did all testings on it) that doesn’t allow to connect. I was able to connect to owa with edge on another computer, which was not used before.

After I got owa to work on PC, I installed user certificate on iphone, and owa works there with certificate too (great!! one problem solved).

However, for some reason active sync still doesn’t work with certificate required on the same iphone. I assume iphone should use same certificate it uses for owa (which works), so certificate is not the problem. Without requiring client certificate it also works, so permissions shouldn’t be the problem. I’m getting error codes 403 7 64 and 403 7 5. Any more suggestions???

Answer 4

Hi @Evald Gruzdev ,

Based on your description, you managed to get OWA to work with certificates on both the PC and iPhone. For ActiveSync issues, here are some additional suggestions that may help you resolve 403 errors:

1. Make sure the client certificate is correctly mapped to the user account in Active Directory. The certificate must contain the User Principal Name (UPN) in the Subject or Subject Alternative Name field.
2. Double-check the IIS settings for the ActiveSync virtual directory. Make sure SSL is enabled and that the Client Certificate Mapping authentication feature is properly installed and configured.
3. Verify that the iPhone trusts the entire chain of trust for the client certificate, including the root certificate and any intermediate CAs.
4. Check if there are any ActiveSync mailbox policies that may be causing this issue. Sometimes, specific policies can interfere with certificate-based authentication.
5. Make sure the Autodiscover service is correctly configured and available for ActiveSync. This service helps the device locate the Exchange server and configure connection settings3.
6. Since you mentioned that Edge may have cached data that caused the problem, you can try clearing the browser cache and cookies again, or resetting the Edge settings to default. Alternatively, testing with a different browser can help isolate the issue.

---

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang