Certificate Requirements for LyncDiscover

The certificate implications for the previous requirements become increasingly important in Lync Server 2013. In the past a single, privately issued certificate was common for all Front End Services. When certificates are being configured for a Lync Front End Server, there is an option to assign a certificate for Default, Internal Web Services, and External Web Services. This essentially enables administrators to assign a certificate for each of the web service directories, and then all other Lync services. With Lync Mobile, the possibility of devices that would not automatically trust the privately issued certificate connecting to the LyncDiscoverinternal service will require either the configuration of a public certificate for the web services, or the manual installation of root certificates on mobile devices.

Table 24.3 outlines a possible certificate configuration to provide Autodiscover Services to all endpoints.

Table 24.3. LyncDiscover Certificate Requirements

In the configuration outlined in Table 24.3, the web services certificate could be applied to the Front End Server web services, as well as the public reverse proxy interface. This would allow for internal clients that are connecting to the internal LyncDiscover service to connect seamlessly, as well as external clients.

The preceding example is just one way to work with the certificate requirements for LyncDiscover. There are many ways to meet the requirements of an organization. The key is that the LyncDiscover records must be present on a certificate, and the clients must trust that certificate.