Problems with Mitigation Service (validating certificate)

Question

Hi guys,

We've successfully updated to Exchange Server 2016 CU22 a few weeks ago. We're stuck at configuring the correct firewall rules. Normally it's just that easy: Accordind to the documentation (HelpConnectivityEEMS) permit all Exchange Servers access to officeclient.microsoft.com/* and you're done. In our case we're not. We noticed that the firewall blocks outbound connections on port 80. To me it looks quite ovious that the service tries to check the certificate for revocation. Normally the connection just times out, when a server is trying to access CRL on internet, but I guess in this case it's not the case because the service is security sensitive. Therefore I understand that the check for revocation must be successful. Ok, first we enabled unrestricted outbound access for the servers on port 80. Which worked, but we don't want to have the Exchange Servers unrestricted internet access on port 80. We've already tried to permit a bunch of well-known CRL URLs in addition to ip adresses blocked by the firewall, but we always get an error when using the get-mitigations.ps1 script:

As you can see the Test-Script works (access to xml endpoint), but the get-mitigations.ps1 does not. In the Eventlog there's an error every hour:

I could find any documentation which URLs are neccessary besides officeclient.microsoft.com. We also tested access through Zscaler proxy. That worked, too, but we don't want unauthorized access through Zscaler because it is paid ber load and not per user. Maybe that are URLs to which all clients should have access to, anyway!? Therefore I have following questions:

1. Does anyone know which CRL URLs have to be permitted exactly to get the mitigation services working or does anywhere exist a general list?
2. Do you just permit Exchange Servers port 80 outbound without restriction to any host?

Thanks for upcoming replies,
Daniel

Answer 1

We managed it. We're running a PaloAlto firewall and my network colleague didn't wanted to configure all those mentioned ip addresses. Because permitting outbound port 80 to any system and any service was neither an option, we tried to permit web-browsing and ocsp (because we saw that has been blocked) without success. Then he decided to permit the communiation on application categories ocsp and ms-update (without web-browsing) and that worked. We're awaiting an approval by IT security but I guess I can close the thread already.

Thanks to all,
Daniel

Answer 2

Hi @Brase, Daniel

According to my search, I got below information provided by Exchange Team Blog

Getting 1008 (This XML is not deemed safe to consume since Response xml's signing cert is invalid or not from microsoft). That is because your firewall, proxy or webfilter is blocking the requests of your Exchange Emergency Mitigation Service. You need to allow all the IPs and/or URLs (depending on your firewall and/or webfilter) of Microsoft, Google and Akamai that it takes to check the XMLs certificate, certificate revocation list, schema and so on.

You can simulate the behaviour of the EEMS by getting the test page with a browser (https://officeclient.microsoft.com/getexchangemitigations). For those of you not being familiar - look at the schema links in the XML document as well as the certificate of the URL and check all the certificate chaining, revocation lists URLs and so on.

For the IPs compare the blocked IPs with the following networks and allow them:

https://www.microsoft.com/en-us/download/details.aspx?id=53602
https://www.gstatic.com/ipranges/goog.json
https://github.com/SecOps-Institute/Akamai-ASN-and-IPs-List/blob/master/akamai_ip_cidr_blocks.lst

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.