Share via

Exchange 2016 when starting exchange administrative service i get an server error in '/owa' application Assert: JMACProvider.getCertificates:protectionCertificates.length<1

Mike Page 0 Reputation points
2026-03-02T14:36:57.56+00:00

Server Error in '/owa' Application. ASSERT: HMACProvider.GetCertificates:protectionCertificates.Length<1 Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. Exception Details: Microsoft.Exchange.Diagnostics.ExAssertException: ASSERT: HMACProvider.GetCertificates:protectionCertificates.Length<1 Source Error: An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below. Stack Trace: [ExAssertException: ASSERT: HMACProvider.GetCertificates:protectionCertificates.Length<1] Microsoft.Exchange.Diagnostics.ExAssert.AssertInternal(String formatString, Object[] parameters) +235 Microsoft.Exchange.Diagnostics.ExAssert.RetailAssert(Boolean condition, String formatString, T1 parameter1, T2 parameter2) +90 Microsoft.Exchange.Clients.Common.HmacProvider.GetCertificates() +359 Microsoft.Exchange.Clients.Common.HmacProvider.GetHmacProvider() +140 Microsoft.Exchange.Clients.Common.HmacProvider.ComputeHmac(Byte[][] messageArrays) +14 Microsoft.Exchange.HttpProxy.FbaModule.SetCadataCookies(HttpApplication httpApplication) +1032 Microsoft.Exchange.HttpProxy.FbaFormPostProxyRequestHandler.HandleFbaFormPost(BackEndServer backEndServer) +3579 Microsoft.Exchange.HttpProxy.FbaFormPostProxyRequestHandler.ShouldContinueProxy() +20 Microsoft.Exchange.HttpProxy.ProxyRequestHandler.BeginProxyRequestOrRecalculate() +257 Microsoft.Exchange.HttpProxy.ProxyRequestHandler.InternalOnCalculateTargetBackEndCompleted(TargetCalculationCallbackBeacon beacon) +1528 Microsoft.Exchange.HttpProxy.<>c__DisplayClass281_0.<OnCalculateTargetBackEndCompleted>b__0() +303 Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action tryDelegate, Func2 filterDelegate, Action1 catchDelegate) +35 Microsoft.Exchange.HttpProxy.ProxyRequestHandler.CallThreadEntranceMethod(Action method) +59 [AggregateException: One or more errors occurred.] Microsoft.Exchange.HttpProxy.ProxyRequestHandler.EndProcessRequest(IAsyncResult result) +413 System.Web.CallHandlerExecutionStep.InvokeEndHandler(IAsyncResult ar) +231 System.Web.CallHandlerExecutionStep.OnAsyncHandlerCompletion(IAsyncResult ar) +172

Exchange | Exchange Server | Management
Exchange | Exchange Server | Management

The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vergil-V 10,340 Reputation points Microsoft External Staff Moderator
    2026-03-02T23:45:40.07+00:00

    Hi @Mike Page 

    Thanks for reaching out to the Microsoft Q&A forum.   

    Based on my research, this error message, Assert: JMACProvider.getCertificates:protectionCertificates.length<1 usually appears when the Exchange Server OAuth certificate has expired or is no longer present on the system. To confirm its current status, you can run the PowerShell command below: 

    (Get-AuthConfig).CurrentCertificateThumbprint | Get-ExchangeCertificate | Format-List 

     

    If it shows that the OAuth certificate is missing or expired, you can generate a new one using: 

    New-ExchangeCertificate -KeySize 2048 ` 
-PrivateKeyExportable $true ` 
-SubjectName "cn=Microsoft Exchange Server Auth Certificate" ` 
-FriendlyName "Microsoft Exchange Server Auth Certificate" ` 
-DomainName @() 
 

    After creating the certificate, assign it for OAuth authentication: 

    Set-AuthConfig -NewCertificateThumbprint <ThumbprintFromAboveCMD> -NewCertificateEffectiveDate (Get-Date).ToUniversalTime() 
Set-AuthConfig -PublishCertificate 
Set-AuthConfig -ClearPreviousCertificate 

     

    When the configuration is complete, restart the Microsoft Exchange Service Host. You can then refresh IIS by running IISReset or recycle the OWA and EAC application pools: 

    Restart-WebAppPool MSExchangeOWAAppPool  
Restart-WebAppPool MSExchangeECPAppPool 

     

    For your reference, you can review: Can't access OWA/EAC with expired OAuth certificate - Exchange | Microsoft Learn 

    You can also review a similar case reported by another user in Exchange Server error in '/owa' application | Microsoft Community Hub 

    I hope this information helps you move forward. If you have any updates, please feel free to share. 

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".         

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.