[Solved]ERR_SPDY_INADEQUATE_TRANSPORT_SECURITY issue in OWA

I am currently using Exchange 2016 CU 4 as of the below version. Few days back my server was working fine and was easily reachable from inside as well as outside domain. on the point I have even used the certificate from DigiCert for SSL verification. Suddenly today I found that ERR_SPDY_INADEQUATE_TRANSPORT_SECURITY issue in OWA while trying to get browse using Chrome or Firefox, and surprisingly everything was good Internet Explorer and Edge Browser. Even with the Safari, it was good and able to login.

Over here sharing my experience how I have sorted out this issue on my Exchange server.

Problem:

Whenever I try to get browse my OWA or ECP though Firefox or Chrome, it was prompting an issue with webpage ERR_SPDY_INADEQUATE_TRANSPORT_SECURITY.

Reason:

Going through the research, I have the deployment of HTTP/2 over TLS 1.2 SHOULD NOT use any of the cipher suites that are listed in the cipher suite black list as of below, Endpoints MAY choose to generate a connection error of type INADEQUATE_SECURITY if one of the cipher suites from the black list is negotiated. A deployment that chooses to use a black-listed cipher suite risks triggering a connection error unless the set of potential peers is known to accept that cipher suite.

Implementations MUST NOT generate this error in reaction to the negotiation of a cipher suite that is not on the black list. Consequently, when clients offer a cipher suite that is not on the black list, they have to be prepared to use that cipher suite with HTTP/2.

The black list includes the cipher suite that TLS 1.2 makes mandatory, which means that TLS 1.2 deployments could have non-intersecting sets of permitted cipher suites. To avoid this problem causing TLS handshake failures, deployments of HTTP/2 that use TLS 1.2 MUST support TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [TLS-ECDHE] with the P-256 elliptic curve [FIPS186].

Note that clients might advertise support of cipher suites that are on the black list in order to allow for connection to servers that do not support HTTP/2. This allows servers to select HTTP/1.1 with a cipher suite that is on the HTTP/2 black list. However, this can result in HTTP/2 being negotiated with a black-listed cipher suite if the application protocol and cipher suite are independently selected.

TLS 1.2 Cipher Suite Black List

An HTTP/2 implementation MAY treat the negotiation of any of the following cipher suites with TLS 1.2 as a connection error of type INADEQUATE_SECURITY:

• TLS_NULL_WITH_NULL_NULL
• TLS_RSA_WITH_NULL_MD5
• TLS_RSA_WITH_NULL_SHA
• TLS_RSA_EXPORT_WITH_RC4_40_MD5
• TLS_RSA_WITH_RC4_128_MD5
• TLS_RSA_WITH_RC4_128_SHA
• TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
• TLS_RSA_WITH_IDEA_CBC_SHA
• TLS_RSA_EXPORT_WITH_DES40_CBC_SHA
• TLS_RSA_WITH_DES_CBC_SHA
• TLS_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA
• TLS_DH_DSS_WITH_DES_CBC_SHA
• TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
• TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA
• TLS_DH_RSA_WITH_DES_CBC_SHA
• TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
• TLS_DHE_DSS_WITH_DES_CBC_SHA
• TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
• TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
• TLS_DHE_RSA_WITH_DES_CBC_SHA
• TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_DH_anon_EXPORT_WITH_RC4_40_MD5
• TLS_DH_anon_WITH_RC4_128_MD5
• TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA
• TLS_DH_anon_WITH_DES_CBC_SHA
• TLS_DH_anon_WITH_3DES_EDE_CBC_SHA
• TLS_KRB5_WITH_DES_CBC_SHA
• TLS_KRB5_WITH_3DES_EDE_CBC_SHA
• TLS_KRB5_WITH_RC4_128_SHA
• TLS_KRB5_WITH_IDEA_CBC_SHA
• TLS_KRB5_WITH_DES_CBC_MD5
• TLS_KRB5_WITH_3DES_EDE_CBC_MD5
• TLS_KRB5_WITH_RC4_128_MD5
• TLS_KRB5_WITH_IDEA_CBC_MD5
• TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA
• TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA
• TLS_KRB5_EXPORT_WITH_RC4_40_SHA
• TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5
• TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5
• TLS_KRB5_EXPORT_WITH_RC4_40_MD5
• TLS_PSK_WITH_NULL_SHA
• TLS_DHE_PSK_WITH_NULL_SHA
• TLS_RSA_PSK_WITH_NULL_SHA
• TLS_RSA_WITH_AES_128_CBC_SHA
• TLS_DH_DSS_WITH_AES_128_CBC_SHA
• TLS_DH_RSA_WITH_AES_128_CBC_SHA
• TLS_DHE_DSS_WITH_AES_128_CBC_SHA
• TLS_DHE_RSA_WITH_AES_128_CBC_SHA
• TLS_DH_anon_WITH_AES_128_CBC_SHA
• TLS_RSA_WITH_AES_256_CBC_SHA
• TLS_DH_DSS_WITH_AES_256_CBC_SHA
• TLS_DH_RSA_WITH_AES_256_CBC_SHA
• TLS_DHE_DSS_WITH_AES_256_CBC_SHA
• TLS_DHE_RSA_WITH_AES_256_CBC_SHA
• TLS_DH_anon_WITH_AES_256_CBC_SHA
• TLS_RSA_WITH_NULL_SHA256
• TLS_RSA_WITH_AES_128_CBC_SHA256
• TLS_RSA_WITH_AES_256_CBC_SHA256
• TLS_DH_DSS_WITH_AES_128_CBC_SHA256
• TLS_DH_RSA_WITH_AES_128_CBC_SHA256
• TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
• TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
• TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA
• TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA
• TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA
• TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
• TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA
• TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_DH_DSS_WITH_AES_256_CBC_SHA256
• TLS_DH_RSA_WITH_AES_256_CBC_SHA256
• TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
• TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
• TLS_DH_anon_WITH_AES_128_CBC_SHA256
• TLS_DH_anon_WITH_AES_256_CBC_SHA256
• TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
• TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA
• TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA
• TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA
• TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
• TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA
• TLS_PSK_WITH_RC4_128_SHA
• TLS_PSK_WITH_3DES_EDE_CBC_SHA
• TLS_PSK_WITH_AES_128_CBC_SHA
• TLS_PSK_WITH_AES_256_CBC_SHA
• TLS_DHE_PSK_WITH_RC4_128_SHA
• TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
• TLS_DHE_PSK_WITH_AES_128_CBC_SHA
• TLS_DHE_PSK_WITH_AES_256_CBC_SHA
• TLS_RSA_PSK_WITH_RC4_128_SHA
• TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
• TLS_RSA_PSK_WITH_AES_128_CBC_SHA
• TLS_RSA_PSK_WITH_AES_256_CBC_SHA
• TLS_RSA_WITH_SEED_CBC_SHA
• TLS_DH_DSS_WITH_SEED_CBC_SHA
• TLS_DH_RSA_WITH_SEED_CBC_SHA
• TLS_DHE_DSS_WITH_SEED_CBC_SHA
• TLS_DHE_RSA_WITH_SEED_CBC_SHA
• TLS_DH_anon_WITH_SEED_CBC_SHA
• TLS_RSA_WITH_AES_128_GCM_SHA256
• TLS_RSA_WITH_AES_256_GCM_SHA384
• TLS_DH_RSA_WITH_AES_128_GCM_SHA256
• TLS_DH_RSA_WITH_AES_256_GCM_SHA384
• TLS_DH_DSS_WITH_AES_128_GCM_SHA256
• TLS_DH_DSS_WITH_AES_256_GCM_SHA384
• TLS_DH_anon_WITH_AES_128_GCM_SHA256
• TLS_DH_anon_WITH_AES_256_GCM_SHA384
• TLS_PSK_WITH_AES_128_GCM_SHA256
• TLS_PSK_WITH_AES_256_GCM_SHA384
• TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
• TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
• TLS_PSK_WITH_AES_128_CBC_SHA256
• TLS_PSK_WITH_AES_256_CBC_SHA384
• TLS_PSK_WITH_NULL_SHA256
• TLS_PSK_WITH_NULL_SHA384
• TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
• TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
• TLS_DHE_PSK_WITH_NULL_SHA256
• TLS_DHE_PSK_WITH_NULL_SHA384
• TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
• TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
• TLS_RSA_PSK_WITH_NULL_SHA256
• TLS_RSA_PSK_WITH_NULL_SHA384
• TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
• TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256
• TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256
• TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256
• TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
• TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256
• TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
• TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256
• TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256
• TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256
• TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
• TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256
• TLS_EMPTY_RENEGOTIATION_INFO_SCSV
• TLS_ECDH_ECDSA_WITH_NULL_SHA
• TLS_ECDH_ECDSA_WITH_RC4_128_SHA
• TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
• TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
• TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
• TLS_ECDHE_ECDSA_WITH_NULL_SHA
• TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
• TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
• TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
• TLS_ECDH_RSA_WITH_NULL_SHA
• TLS_ECDH_RSA_WITH_RC4_128_SHA
• TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
• TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
• TLS_ECDHE_RSA_WITH_NULL_SHA
• TLS_ECDHE_RSA_WITH_RC4_128_SHA
• TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
• TLS_ECDH_anon_WITH_NULL_SHA
• TLS_ECDH_anon_WITH_RC4_128_SHA
• TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
• TLS_ECDH_anon_WITH_AES_128_CBC_SHA
• TLS_ECDH_anon_WITH_AES_256_CBC_SHA
• TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA
• TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA
• TLS_SRP_SHA_WITH_AES_128_CBC_SHA
• TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA
• TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA
• TLS_SRP_SHA_WITH_AES_256_CBC_SHA
• TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA
• TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA
• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
• TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
• TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
• TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
• TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
• TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
• TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
• TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
• TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_PSK_WITH_RC4_128_SHA
• TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
• TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
• TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
• TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
• TLS_ECDHE_PSK_WITH_NULL_SHA
• TLS_ECDHE_PSK_WITH_NULL_SHA256
• TLS_ECDHE_PSK_WITH_NULL_SHA384
• TLS_RSA_WITH_ARIA_128_CBC_SHA256
• TLS_RSA_WITH_ARIA_256_CBC_SHA384
• TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256
• TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384
• TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256
• TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384
• TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256
• TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384
• TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256
• TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384
• TLS_DH_anon_WITH_ARIA_128_CBC_SHA256
• TLS_DH_anon_WITH_ARIA_256_CBC_SHA384
• TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256
• TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384
• TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256
• TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384
• TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256
• TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384
• TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256
• TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384
• TLS_RSA_WITH_ARIA_128_GCM_SHA256
• TLS_RSA_WITH_ARIA_256_GCM_SHA384
• TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256
• TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384
• TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256
• TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384
• TLS_DH_anon_WITH_ARIA_128_GCM_SHA256
• TLS_DH_anon_WITH_ARIA_256_GCM_SHA384
• TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256
• TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384
• TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256
• TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384
• TLS_PSK_WITH_ARIA_128_CBC_SHA256
• TLS_PSK_WITH_ARIA_256_CBC_SHA384
• TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256
• TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384
• TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256
• TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384
• TLS_PSK_WITH_ARIA_128_GCM_SHA256
• TLS_PSK_WITH_ARIA_256_GCM_SHA384
• TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256
• TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384
• TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256
• TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384
• TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
• TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
• TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
• TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
• TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
• TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
• TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
• TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
• TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
• TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
• TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256
• TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384
• TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256
• TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384
• TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256
• TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384
• TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
• TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
• TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
• TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
• TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
• TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
• TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
• TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
• TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
• TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
• TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
• TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
• TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
• TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
• TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
• TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
• TLS_RSA_WITH_AES_128_CCM
• TLS_RSA_WITH_AES_256_CCM
• TLS_RSA_WITH_AES_128_CCM_8
• TLS_RSA_WITH_AES_256_CCM_8
• TLS_PSK_WITH_AES_128_CCM
• TLS_PSK_WITH_AES_256_CCM
• TLS_PSK_WITH_AES_128_CCM_8
• TLS_PSK_WITH_AES_256_CCM_8

Source: https://http2.github.io/http2-spec/#BadCipherSuites

Resolution:

This seems quite nerd for me… I wanted to have quick solution as my service was getting disrupted. Hence, I choose the help of IISCrypto and it was quite handful for me. What I did was I downloaded the IISCrypto copied it to my Exchange server and Executed it. During the execution, I just clicked on Best Practice. It automatically disabled the blacklisted TLS and gave me only the good one.

After onward I applied the Schannel for my exchange server… and BOOOOOM!!!!! Everything was alright…. My issue was just I have enabled few blacklisted TLS Encryption.

Hope this will help you guys.