Shulou(Shulou.com)06/03 Report--

Recently, after dealing with the maintenance of a user, the certificate assigned by IIS on the exchange 2016 server is automatically gone, and the Exchange server uses the certificate to encrypt the data transmission with the client or other server. how can the certificate be lost on its own? I found a similar problem in the Microsoft forum. Let's share with you the process of dealing with this problem.

Environment description:

Operating system: Windows Server 2012 R2

Exchange version: exchange 2016 CU2

Problem description:

When you restart the IIS service, the certificate bound on the IIS Default Web Site disappears and becomes unselected (Not selected):

Process:

Check the event log and find the events of Event ID 15300 and Event ID 15301, as shown below:

At this point, we suspect that there are other programs that operate on the certificate. So Process Monitor is installed on the Exchange server where the problem occurred. After that, try to restart the IIS service and grab the process of the certificate being modified.

Analyzing after stopping log interception, it was found that the process named iCRCService.exe and SRService.exe deleted and updated the certificate through the registry.

Combined with the system information on this server (viewed by running msinfo32), there are Trend Micro series products in the installed program. Basically locked, the problem occurs in these programs of Trend Micro.

For comparison, we also use Process Monitor to intercept the IIS reset process in the normal experimental environment, and we can see that the normal process of updating the certificate should be inetinfo.exe (the main component of the IIS server).

Finally, users adjust the settings of Trend Micro-related applications to avoid modifying the IIS certificate at run time. When you restart the server or IIS service, there will be no certificate loss.

Recommendations:

If we install antivirus software on the exchange server, we recommend that you make an exception to the exchange installation directory and the IIS directory

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.