Install Certificates

Before creating rules or Forefront Threat Management Gateway rules the appropriate certificates should be installed on the server. The required subject name should match the external URL of the pool and include subject alternative names for simple URLs created for dial-in conferencing or meetings. If the Lync Server Certificate Wizard is used, the External Edge services certificate may already contain all the required names.

To present the certificate to external clients, the certificate must have the private key associated. If exporting certificates from other servers, include the private key. If the private key is not available for export, the certificate might need to be re-issued, but with the “private key is exportable” option.

Additionally, be sure the Forefront Threat Management Gateway has the root certificate of any internal certificate authorities used to issue certificates to internal Lync Server pools. For Threat Management Gateway to successfully publish internal pools, it must be able to access the HTTPS ports on the internal servers and trust the certificates presented for web services.