Office Online - Could not establish trust relationship for the SSL/TLS secure channel with authority

Symptoms

Office Online Server fails to open Office documents and leaves this error in the Office Web Apps event logs:

 

System.ServiceModel.Security.SecurityNegotiationException: Could not establish trust relationship for the SSL/TLS secure channel with authority '<servername>:809'. ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

 



 





Diagnosis


IIS sites have the unsupported HSTS configuration:

  • HSTS ==> “Redirect Http to Https”

It needs to be enabled for the IIS security, but it breaks the Office Online functionality.

Remedy


Uncheck (disable) the “Redirect Http to Https” checkbox for both HTTP80 and HTTP809 sites:











The “Enable” and “IncludeSubDomains” options do not cause the outage. Therefore, they can be left enabled.  No need to restart any of the services.

 

Popular posts from this blog

SharePoint Subscription Edition, Offline Prerequisite Installation

Image
Microsoft has simplified the installation of SharePoint Server Subscription Edition (SE) compared to previous versions, a significant improvement for administrators. However, it is important to note a new prerequisite introduced with the March 2023 update (version 23H1 , 16.0.16130.20206): because the software was recompiled with the Visual C++ 2022 compiler , the Visual C++ Redistributable Package for Visual Studio 2015-2022 (in lieu of the 2015-2019 version) has since become the new prerequisite for subsequent SE installations. Currently the latest major feature release is 25H2  (Sept. 2025). Recently I had to install SE  offline  with the latest cumulative updates, so I pre-downloaded the Visual C++ 2015-2022 Redistributable and the March 2026 CU (KB5002843, 16.0.19725.20076) for slipstreaming. That process exposed a bit of SharePoint pain. Two things: 1. (Minor) The Visual C++ Redistributable file name is the same between the old and new packages -  VC_redist.x...
Read more

October 2025 SharePoint CU Failed to Install After Applying September 2025 SharePoint CU

Image
[Tested on SharePoint 2016 only] Applying the September 2025 SharePoint Cumulative Updates to SharePoint On-Prem was a bit chaotic as it introduced a number of bugs. It would have been better if I had the option to skip it and go straight to the October CU. Stefan, Sr. SharePoint Escalation Engineer at Microsoft, has summarized the issues very well on  his blog . While many of the issues have been fixed in the October CU release, the fix for the "installation of this package failed" error  was not included for those who had already applied the September CU before the fix was made. That is, the System and Local Service accounts have to be manually removed from the WSS_WPG and IIS_IUSRS groups before applying the October CU. Without this step, I encountered a new popup error that said: Error 2349. An internal error has occurred. ( ) Contact Microsoft Product Support Services (PSS) for assistance. For information about how to contact PSS, see PSS10R.CHM. Remedy Remove the...
Read more

Strange Read-Only Behaviors of Site Collections

Image
[SharePoint 2016, 16.0.5530.1000]  Suppose you have a site collection in read-only mode and want to remove that status. Normally this is achieved by selecting the " Not locked " option on the " Site Collection Quota and Locks " page in Central Admin or by running one of the following PowerShell commands: (Get-SPSite "<https://siteCollectionUrl>").ReadOnly = $false or Set-SPSite "<https://siteCollectionUrl>" -LockState Unlock There is also the LockState parameter of the Set-SPSiteAdministration command that can be utilized, but I did not try it in this particular case. Nonetheless, there is a rare case where neither of these PowerShell commands works. They do not output any errors in PowerShell or even in verbose-enabled ULS logs when they fail to run, and the interface in Central Admin is grayed out as follows: The site collection is truly locked for read-only access, as site collection admins do not see the full site menu. Additiona...
Read more