security certificate revoked - outlook.office365.com

John Rovel Kalaw 6

The pictures below started popping up on our PCs. and the PC was using not part of any domain. I tried to follow the link below but the IE was inaccessible. https://answers.microsoft.com/en-us/outlook_com/forum/all/outlookoffice365com-security-certificate-has-been/743bdb2b-06ce-4206-923e-bdb7041528bd

Drifter 1 Reputation point

2022-10-08T18:50:23.963+00:00

I am not a computer person and also have this problem. I clicked into the Security Alert message's "View Certificate" button and saw that the certificate is issued to "outlook.com" while the security message said the internet address "outlook.office365.com" has security concern. That to me essentially is a Microsoft mess up by using Peter's credential to do business as Paul.

I think that I started to have this pop up issue around when the new certificate became effective, that was 7/25/2022.

As to some PCs/Macs don't have the issue maybe because they already have the correct security certificate installed on their computers. There is no setting in my hotmail setup for me to change in Outlook, so so far I am dealing with it by clicking ok on the box everyday.

49 answers

JB22 1 Reputation point

2022-11-02T18:24:41.063+00:00

Within Microsoft 365 Admin Center [https://admin.microsoft.com], go to Health > Service Health. If it’s unavailable in your tenant, open a case with Microsoft and reference that advisory number and have them add it to your tenant.
Was this answer helpful?
Rod MacPherson 16 Reputation points

2022-11-02T18:35:19.623+00:00

Hmm, that advisory doesn't show for me, I have sent in a report mentioning the advisory # and this forum.
The more info they have the better.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
JB22 1 Reputation point

2022-11-02T18:05:46.343+00:00

Finally - Microsoft has posted an advisory [EX455084] on this issue.
Was this answer helpful?
Rod MacPherson 16 Reputation points

2022-11-02T18:10:59.777+00:00

Where can I find this advisory posting?

DawnLowery-5745 81 Reputation points

2022-11-02T21:14:19.48+00:00

I see it in our portal now as well. I also clicked the link in the service announcement to reflect that my client was having the issue.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
megs28 6 Reputation points

2022-11-02T16:10:36.46+00:00
When I had the error this morning, I see the below in my CAPI2 log. It lead me to checking the issuing CAs to see if I trusted them and I noticed I didn't have either of the intermediate CAs for DigiCert Cloud Services CA-1. I think I've seen it issued by both the new and old intermediate CA... Always the same root CA, and I have yet to find any certs that are listed as expired in the crl.

The list of CAs MS apparently uses is here, and I should have them installed already? https://learn.microsoft.com/en-us/microsoft-365/compliance/encryption-office-365-certificate-chains?view=o365-worldwide

I'm trying the two for the DigiCert Cloud Services CA-1 and will see what happens. I realize this doesn't match up with any revoked cert error, but I figured it doesn't hurt to try. I also see it's lsass, but again, figured it can't hurt to try.

I also find it strange that the 4 instances we have had this morning, 3 of the times it was after the person was away from the PC for a bit, and once was when it came out of hibernation this AM.
<CertVerifyCertificateChainPolicy> <Policy type="CERT_CHAIN_POLICY_MICROSOFT_ROOT" constant="7" /> <Certificate fileRef="F7DA87B0B58B2A2EEC386EC7A60AB14D5A60A499.cer" subjectName="outlook.com" /> <CertificateChain chainRef="{3BD14261-79CD-4F1C-9F04-D87B6752C13D}" /> <Flags value="20000" MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG="true" /> <Status chainIndex="0" elementIndex="2" /> <EventAuxInfo ProcessName="lsass.exe" /> <CorrelationAuxInfo TaskId="{5E002671-EFDF-4383-808F-B28A1CF1B431}" SeqNumber="1" /> <Result value="800B0109">A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.</Result> </CertVerifyCertificateChainPolicy>
Was this answer helpful?
Jonathan Martineau 1 Reputation point

2022-11-04T17:41:43.89+00:00

We push the Intermediate Cert on our test machines, and we still get the errors.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Jacob Cavaness 11 Reputation points

2022-11-02T15:29:07.87+00:00

INFORMATION UPDATE:

My coworker just got off the phone with Microsoft Support and we were told that this is a Global Issue, and that they are working to resolve it.

For a reference I have left the case number below if you happen to call-in/chat with support.

CASE# 33672891
Was this answer helpful?

2 people found this answer helpful.
CO 11 Reputation points

2022-11-02T17:15:59.293+00:00

Case # 33676192 Here..

Keep calling them in and reference the two other cases if you can. It seems to be all Canada East area / regional issues

Cameron R 6 Reputation points

2022-11-02T17:33:38.88+00:00

It's not just Canada area. I've stated I live in KY (USA) and several of my customers are experiencing this issue.

DawnLowery-5745 81 Reputation points

2022-11-02T17:56:02.91+00:00

My case is #:33659688 They are asking me to do a remote connectivity analyzer test, which I believe succeeded 100% if I recall the previous 20 times, I ran it this week doing my troubleshooting.

Chris Robb 21 Reputation points

2022-11-02T18:01:01.53+00:00

Believe me, I understand how frustrating an intermittent issue is to troubleshoot, but Microsoft needs to understand that this often can't be replicated. If you haven't already, I'd suggest pointing them to this thread to see how broadly it's impacting people by geographic location, datacentre, tenant, connection, on-prem/off-prem, OS, and Outlook client. Perhaps even point them to the other case mentioned in this thread 33672891.

Seems like they're finally aware at least.

Not that those dealing with this issue want to hear this, but we haven't had any reported reoccurrences since last Friday (October 28th).

Chris

DawnLowery-5745 81 Reputation points

2022-11-02T18:02:21.62+00:00

I provided the thread in my ticket response to them already and sited that others have cases open and that this is not isolated to my client

Jacob Cavaness 11 Reputation points

2022-11-02T19:46:32.973+00:00

Hello neighbor, we are located in Brownsville, Tennessee.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Mr.Chad 1 Reputation point

2022-11-02T15:02:06.663+00:00

Morning,

I am new to this forum but wanted everyone's opinion. I have a small number of users that are experiencing this issue. So, I check the serial number from the issued DigiCert cert and cross-referenced the data with the website "https://certificate.revocationcheck.com/outlook.com". I noticed the serial number is different from the website and the issue cert. I wonder if this could be the cause for some of my users.
Was this answer helpful?
CO 11 Reputation points

2022-11-02T16:02:41.597+00:00

The CRL's for the cert don't actually have the fingerprint in there.
Depending on which geographical area you connect from you will get a different load balancer and likely a different cert.

For the cert: 0f12dc8955821d6d936bcf34e50f60c5
The CRL's are:

----------

[1]CRL Distribution Point
Distribution Point Name:
Full Name:
URL=http://crl3.digicert.com/DigiCertCloudServicesCA-1-g1.crl
[2]CRL Distribution Point
Distribution Point Name:
Full Name:
URL=http://crl4.digicert.com/DigiCertCloudServicesCA-1-g1.crl

Neither of those CRL's have the fingerprint listed.

Both URL's return the same CRL: bebff6803b4d8f357a1b95d585b7a95340217f3a

----------

All entries in the revoked list are 0xxxxxx and only one 0f which is 0f153da..... which doesn't match this cert. Which is weird that it's erroring. That's as far as I've looked into it.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

security certificate revoked - outlook.office365.com

49 answers

Your answer