Can someone lay out exactly what the certificate for UM/Lync 2013 needs to be?

Question

Ok, so I spent 480 minutes on my cell phone dealing with this same problem with MS a few weeks ago and they fixed it without telling me exactly what was wrong.  I'm doing another Lync 2013 install and still can't get it to talk to UM.
I need to know the following:
Does the cert for the Exchange 2013 UM services need to be issued from the CA or do I use one of the existing Exchange certs?
What does the subject name need to be?
What needs to be included in the SANs?
After the cert is created, do any changes need to be made to the Lync server, or is the cert simply assigned to the UM roles via Exchange Admin Center, restart UM services, and it works?

Answer 1

You can issue the cert from an internal CA or use a self signed cert as long as it's trusted by Lync.
The subject name should be the server's FQDN.
Nothing else really needs to be a SAN unless you're assigning this cert to a service outside of UM, for example if you needed it to also have a webmail.domain.com or autodiscover.domain.com for the CAS role.
Your best bet is to just let the Exchange certificate wizard create it for you, and nothing really needs to change on the Lync server side, but when you bring the services up you might want to do it during off hours.  I've seen an issue where for the
UM server takes a moment longer to get up to speed and rejects calls sent at it for 15 or so minutes.  But, it should just work. 
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications