Certificates

Incorrectly issued certificates are a potential issue with Edge Server configuration. It is common for Intermediate and Root Certificates to be missing from Edge Server Deployments. This will cause intermittent, or even complete, failures on most connections to the Edge Server. Confirm that you have all required certificates installed from your public Certificate Authority. DigiCert offers a free certificate-checking utility online that can verify the proper installation of certificates. This tool can be found at http://www.digicert.com/help.

Tip

As a best practice, always use the built-in Certificate Wizards because they automatically generate the correct names for a server role. Only the Access Edge and Web Conferencing Edge certificates need to be issued by a public certificate authority. The internal Edge certificate and A/V Authentication certificates are used only by internal clients.

Follow the guidelines to rule out certificate issues.

• Key Bit Length—The certificate bit length must be 2048, or 4096, to be supported by Lync Server.

• Template—The template used to issue the certificate should be based on the web server template. If the Lync Server Certificate Wizard is used, the correct template is automatically applied.

• Private Key—The server certificate must have the private key associated to be used by Lync Server. In situations in which certificates are exported or copied between servers, export the private key with the certificate.

• Certificate Chain—The Edge Server must be able to verify each certificate up to a Trusted Root Certification Authority. Additionally, because the server presents the certificate to clients, it must contain each intermediate certificate in the certificate chain.

• Certificate Store—All certificates used by the Edge Server must be located in the Personal section of the local computer certificate store. A common mistake is to place certificates in the Personal section of the user account certificate store.

• Certificate Trust—Be sure that the clients and servers communicating with the Edge Server all contain a copy of the top-level certificate authority of the chain in their Trusted Root Certification Authority local computer store. When the certification authority is integrated with Active Directory, this generally is not an issue. When using an offline or nonintegrated certificate authority, install root certificates on clients and servers.

Additionally, each service has slightly different requirements for the subject and subject alternative names.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset