Test-OAuthConnectivity fails from on premises exchange to O365

[serverpro]

 I ran HCW and it completed successfully but at the end it gave warning that OAuth could not be setup please re run the HCW or try setting up OAuth manually. I re ran the Oauth still same issue hence followed the steps mentioned in the TechNet  article

After successfully following al the steps I tried to test the OAuth connectivity from on premises exchange to office 365 by running the command: Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com/ews/exchange.asmx -Mailbox <On-Premises Mailbox> -Verbose | Format-List 

Got the error below:

RunspaceId  : 33d7dd07-9028-40f8-bfa9-1f8ed554765gf
Task        : Checking EWS API Call Under Oauth
Detail      : The configuration was last successfully loaded at 01-01-0001 00:00:00 UTC. This was 10923476 minutes ago.
              The token cache is being cleared because "use cached token" was set to false.
              Exchange Outbound Oauth Log:


              Exchange Response Details:
              HTTP response message: 
              Exception:
              System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> 
              System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

 When testing the OAuth connectivity from O365 to exchange server it is successful.

Any help would be appreciated 

[#2]

@serverpro 

Hi, what version of Exchange is your hybrid server running, and do you have any other Exchange servers in the environment.  If so, what versions are they running, and are they all up to date with latest SP and CUs?

Also, what SSL certificate do you have for your hybrid config?  It needs to be an externally signed SSL cert and I usually find that a wildcard or SAN cert works best.

[#3 · Accepted solution]

@PeterRising thanks for your help..

The issue was due to the firewall blocking office 365 ews . I allowed the URL in F5 firewall and it resolved the issue