Certificates

Incorrectly issued certificates were a common issue in Office Communications Server deployments, but these issues should mostly be mitigated with the new Lync Server wizards. The option to manually request and modify the certificate still exists, which might lead to some problems.

Follow the following guidelines to rule out any certificate issues:

• Subject and subject alternative names—Ensure that the required subject name and subject alternative names have been entered for each role. The guidance for each role varies, so verify the names required when deploying a new server. Always use the certificate wizard suggested names if possible. Wildcard certificates are still technically unsupported for most scenarios.

• Key bit length—The certificate bit length must be 1024, 2048, or 4096 to be supported by Lync Server 2010.

• Template—The template used to issue the certificate should be based on the web server template. If the Lync Server 2010 certificate wizard is used, the correct template will automatically be applied.

• Private key—The server certificate must have the private key associated to be used by Lync Server 2010. In situations where certificates are exported or copied between servers, export the private key with the certificate.

• Certificate chain—The server must be able to verify each certificate up to a Trusted Root Certification Authority. Additionally, because the server is presenting the certificate to clients, it must contain each intermediate certificate in the certificate chain.

• Certificate store—All certificates used by a server must be located in the Personal section of the local computer certificate store. A common mistake is to place certificates in the Personal section of the user account certificate store.

• Certificate trust—Be sure the clients and servers communicating with the server all contain a copy of the top-level certificate authority of the chain in their Trusted Root Certification Authority local computer store. When the certification authority is integrated with Active Directory this is generally not an issue, but when using an offline or nonintegrated certificate authority it might be necessary to install root certificates on clients and servers.