Server Certificates

In recent years, Microsoft has adopted a “secure out of the box” approach for both operating system and application releases. Lync Server 2013 continues with that same approach, requiring SSL certificates to protect communications between Lync servers, as well as between client and server. In addition, a second type of certificate is being introduced with Lync Server 2013, the Open Authentication (OAuth) certificate. While the SSL certificates will continue to be used to encrypt communications, the OAuth certificates will be used to establish trust across the Office 2013 family of servers. The OAuth certificates allow the exchange of security tokens that grant access to resources for a period of time. Server-to-server authentication and authorization using OAuth is supported between Lync 2013 servers, as well as among Lync 2013, Exchange 2013, and SharePoint 2013 servers for integration scenarios.

The certificates applied to Lync Server systems can be either public certificates issued by a third party certificate authority (CA), or internal certificates issued using a self-managed public key infrastructure (PKI). The most ideal scenario for most organizations is to use a mix of both public and internal certificates for the Lync deployment, with third-party certificates being used for services that are public-facing (such as Edge services), and internal certificates being used for services that are strictly internal (such as communication between Lync Front End Servers). Although this hybrid approach serves to meet the certificate requirements of Lync and reduce the cost of the certificates, it does require that an internal PKI be deployed before the installation of the Lync environment. Since an internal PKI deployment is a project unto itself, organizations that do not already manage an internal PKI deployment will likely need to procure server certificates from a third-party CA for Lync services. The one exception to this is the OAuth certificate, since this can be a self-signed certificate generated internally.

The topic of how to plan and manage an internal PKI goes well beyond the scope of this chapter. However, the specifics of what types of certificates are required for Lync are included here to allow for this aspect of a Lync deployment to be planned appropriately.