Exchange 2003 server with HTTP Proxy (for remote office workers) was working fine until the validated SSL Cert Expired. (Nobody knew about it, and apparently nobody got an email.) OWA was still available for users, but Outlook was broken. I am not certain if iPhone users could use the cert during this time, but I think so.

I purchased a new cert and installed it, and Outlook clients could connect. Rejoicing happened.

Until someone noticed that they couldn't connect with iOS.

I've gone through significant troubleshooting, validating the IIS settings describing that Secure Forms are not required, and individual security settings on the Exchange, exchange-owa, etc virtual directories.

Running the Microsoft Connectivity Analyzer to test Exchange ActiveSync ultimately fails on the Activesync session

Attempting the FolderSync command on the Exchange ActiveSync session.
The test of the FolderSync command failed.

Additional Details
An HTTP 403 forbidden response was received. The response appears to have come from Unknown. Body of the response: <body><h2>HTTP/1.1 403 Forbidden</h2></body>

Headers received:
MicrosoftOfficeWebServer: 5.0_Pub
Pragma: no-cache
MS-Server-ActiveSync: 6.5.7638.1
Content-Length: 44
Content-Type: text/html
Date: Wed, 03 Jul 2013 19:25:17 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET

I have also verified that Exchange ActiveSync is enabled both Globally and at the individual user level in Exchange. I have tried toggling the global setting off and on, both between restarts of Exchange (SA + other core services) as well as the Exchange server itself.

Unlike this question here, the return code is 403, and my SSL Cert is working.

Where can I go from here to try to get this working


I know of no way that you could see the behavior you're seeing now w/o changes to the IIS configuration outside of the installation of a new certificate. I'd strongly recommend restoring a backup of the IIS metabase from prior to any changes being made since, presumably, Active Sync was working fine "before".

If you don't have a metabase backup then I'd recommend biting the bullet and restoring the default virtual directories and walking thru the setup process again, very deliberately. You can't make things much worse since you're currently having an outage anyway.

  • Yes, that is part of my confusion as there were no other changes. The other part of my confusion is that it's just ActiveSync that's broken; half of this company's users are outside of the LAN, so their Outlook is configured to use the HTTP proxy, and are doing so successfully. – gWaldo Jul 3 '13 at 22:02
  • @gWaldo - ActiveSync and RPC-over-HTTP don't share much in common. They both access the IIS server using HTTP over SSL but, beyond that, there's nothing in common. I'm not surprised at all that one works but the other doesn't. ActiveSync is a very, very finicky and rickety web application with piss poor error reporting (a lot of 500 errors instead of actual error messages, no logging at all, etc). – Evan Anderson Jul 3 '13 at 22:07
  • I'm not disagreeing with you that they're different problems, but I'm head-desking over a "permissions" issue, when it's clear that the right to use mobile is set in Exchange! – gWaldo Jul 4 '13 at 22:30
  • Evan, Excellent call on restoring the IIS Metabase. That ended up fixing the issue. – gWaldo Jul 5 '13 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.