Edge server certificate

Hello,
We have added another SIP domain to our lync server, oldsip.com and newsip.com. newsip.com is set to default. oldsip.com will be retained for a while and eventually removed.
When i try to generate certificate on the edge server, the sip.oldsip.com and webconf.oldsip.com are still retained by default and in the next step allows me choose either oldsip.com or newsip.com.
i don't want to include any host entries for oldsip.com, how do i do that?

Hi,
You can request the certificate through Lync management shell.
Following article may help you ;
http://technet.microsoft.com/en-us/library/gg425723.aspx
Thanks
Saleesh
If answer is helpful, please hit the green arrow on the left, or mark as answer. Blog : http://blogs.technet.com/b/saleesh_nv/

Similar Messages

Lync Edge Server Certificate Issue

I've implemented a single internal Standard Edition
Front End server with a single consolidated Edge server and Reverse Proxy server/appliance located in a perimeter network.
On the internal IP of the Edge server I use a certificate form a internal CA ( which is trusted by the edge server), the "internal" certificate issued by the internal Ca is used only between the edge server and the frontend server. An external certificate
with cn sip.ipabo.nl and alt.subj sip.ipabo.nl and webconf.ipabo.nl. from Globalsign is used on the external IP’s . Services have their own ip adresses and are natted by a router. Ive tested that all ports can be reached from the internet. But still no connection
possible from external clients. The ms. connectivity analyser says: "The The certificate couldn't be validated because SSL negotiation wasn't successful". Connections from mobile clients through reverse proxy are no problem also internal clients
have no issue ( they both don’t use the edge but proxy ). So i assume there's someting wrong with the certificate implementation on the Edge server, however ive tested it with the RUCT from Curtis Johnstone, and the certificate seems to be OK. Also in the
Lync Server Deployment Wizard the certificates seem to be OK. In the computers personal certificate store the are only the two necessary certificates ( internal and external) also intermediate certificates are installed. Routing ( default gateway on external
interface ) is working fine. So I think I'm out of options, any ideas?
Tnx,
Guido

Ok I found It:
It was a simple setting in the Control panel, or in the management shell:
In Set-Accessedgeconfiguration
AllowOutsideUsers was set to False. this should be true.
I found it by Using OCSlogging on the Edgeserver, looking at SIP.
So I don't understand how all the certificate and server unavailable warnings make any sense.
The next issue will be exchange integration :)
Thanks for your help everybody

Exporting Edge server certificate

Part of my upgrade of the Edge from 2010 to 2013 is to export out the certificates on the 2010 so I can import them into the 2013 Edge. Can I just use the MMC Certificate snapin to do this or is there some powershell command I must use. I took a look at
the setup program and there is no export option in Step 3.
If I use the MMC, I am guessing I choose the option to export with private key or does it matter?

Hi,
Export the certificates using the certificates MMC, ensure that you export the private key or they will be useless when you re-import them.
You can then just use the Lync setup to assign the newly imported certificates for the correct usage.
HTH
Matt

Can you use a self signed certificate on an external Edge Server interface?

Hi,
I have a small lab deployment for evaluation purposes. The Lync FE server works great for internal users. I have now added an Edge server. For the internal interface, I have a self signed certificate from our internal CA. (no problem there) For the external
interface, I have a self signed certificate from our own external CA. I have installed the cert on the client machine of the external user and installed it for trusted operation. I have used the RUCT and digicert tools to prove that the external self signed
cert is valid (root and intermediate have been checked for validity).
At first, when logging in from the Lync 2013 client on the external users machine, I would get an error from Lync about the cert being untrusted. I have now fixed that error by adding it as trusted. At this point, there are no errors or warnings in the Event
Viewer (in the application or system logs) However, I receive the following error from the Lync client, "Were having trouble connecting to the server... blah, blah".
Here is my question. Does the Microsoft Lync 2013 client and/or the "testconnectivity.microsoft.com" tool specifically prevent or forbid the use of self signed certificates on the external interface of an Edge server? They seem too.
I can tell if the certificate is my problem or something else. Any ideas on how to trouble shoot this?
Thx

Drago,
Thanks for all your help. I got it working.
My problem with the Lync client error, "Were having trouble connecting to the server... blah, blah", was NOT a certificate error. It was a problem with my Lync Server Topology. (My sip default domain needed to match my user login domain.)
Let me update everyone about self-signed certificates:
YES, you can self-sign a certificate on your external edge server. It is a pain, but possible.
I have a self signed certificate from our own external CA. I have installed the cert on the client machine of the external user for trusted operation. I have used the RUCT and digicert tools to prove that the external self signed cert is valid (root and
intermediate have been checked for validity).
Here are my notes:
Create/enable your own external Certificate Authority (CA) running on a server with internet access.
On the Lync Edge Server, run the "Lync Server 2013 - Development Wizard".
Click "Install or Update Lync Server System". (Lync will automatically determine its deployment state)
You should have already completed: Step1 and Step 2.
Run or Run Again "Step 3: Request, Install or Assign Certificates".
Install the "Edge internal" certificate.
Click "Request" button to run the "Certificate Request" wizard.
You use can "Send the request immediately to an online certificate authority" option to connect to your internal CA, and create the certificate.
Once the certificate has been created, use "Import Certificate" to import it.
Once imported, on the Edge Server, go to: (Control Panel -> Administrative Tools -> Internet Information Services (ISS) Manager -> Server Certificates -> Complete Certificate Request...
In the Lync deployment wizard - Certificate Wizard, "Assign the newly imported "edge internal" certificate.
Install the "Edge External" certificate (public Internet).
Click the "Request" button to run the "Certificate Request" wizard.
Press "next"
Select "Prepare the request now, but send it later (offline certificate request).
Supply the "Certificate Request File" name and location. (You will need the file later. It should have the file extension ".req").
Click next on the "Specify Alternate Certificate Template". (which means you are using the default options)
Give it a Friendly Name. Bit Length = 2048. I selected "Mark the certificate's private key as exportable" option.
Fill in the organization info.
Fill in the Geographical Information.
The wizard should automatically fill-in the "Subject name:" and "subject alternative name:' fields.
Select your "Configured SIP domains"
"Configure Additional Subject Alternative Names" if you want. Otherwise, next.
Verify the "certificate Request Summary". Click next.
Run the wizard script to "Complete". The wizard will create a file containing the certificate request with the file extension ".req". (Let's assume the file name is "myCert.req")
Move your myCert.req file to your external CA. Have your CA issue the cert (based on myCert.req) and export the new cert to a file. I save it as a P7B certificate. (Let's call it "ExternalCert.p7b")
In the Lync Deployment wizard - Certificate Wizard, click on "Import Certificate" for ExternalCert.p7b.
Once imported, on the Edge Server, go to: (Control Panel -> Administrative Tools -> Internet Information Services (ISS) Manager -> Server Certificates -> Complete Certificate Request... (assign it a friendly name. Let's say "EXTERNAL-EDGE")
For the "External Edge certificate (public Internet), click "Assign".
The "Certificate Assignment" wizard will run.
Click next.
From the list, select your cert "EXTERNAL-EDGE".
Finish the wizard to "complete".
You are finished on the server.
Move the "ExternalCert.p7b" file to the machine running the lync client. Install the cert via the "Certificate Import Wizard".
When installing it to a particular Certificate Store, select the "Place all certificates in the following store" option.
Browse
Select "Trusted Root Certification Authorities"
Finish the wizard.

Lync Edge Server 2013 Certificate Issue seems unresolvable

I've implemented a single internal Standard Edition Front End server with a single consolidated Edge server and Reverse Proxy server/appliance located in a perimeter network.
On the internal IP of the Edge server I use a certificate form a internal CA ( which is trusted by the edge server), the "internal" certificate issued by the internal Ca is used only between the edge server and the frontend server. An external certificate
with cn sip.ipabo.nl and alt.subj sip.ipabo.nl and webconf.ipabo.nl. from Globalsign is used on the external IP’s . Services have their own ip adresses and are natted by a router. Ive tested that all ports can be reached from the internet. But still no connection
possible from external clients. The ms. connectivity analyser says: "The The certificate couldn't be validated because SSL negotiation wasn't successful". Connections from mobile clients through reverse proxy are no problem also internal clients
have no issue ( they both don’t use the edge but proxy ). So i assume there's someting wrong with the certificate implementation on the Edge server, however ive tested it with the RUCT from Curtis Johnstone, and the certificate seems to be OK. Also in the
Lync Server Deployment Wizard the certificates seem to be OK. In the computers personal certificate store the are only the two necessary certificates ( internal and external) also intermediate certificates are installed. Routing ( default gateway on external
interface ) is working fine. So I think I'm out of options, any ideas?
Tnx,
Guido

Please check the DNS records for sip.ipabo.nl and webconf.ipabo.nl are created on external DNS server.
Please check you can telnet Lync Edge Access service FQDN on 443 port.
Check the automatic configuration for remote access is configured correctly or you can try to sign in manually.
Follow the steps in blog blow to test your Edge Server:
http://blogs.technet.com/b/nexthop/archive/2011/12/07/useful-tips-for-testing-your-lync-edge-server.aspx
Lisa Zheng
TechNet Community Support

Lync 2013 edge server request certificates

I am deploying Lync 2013 edge server, how to get the certificate request file[certificate
signing request (CSR)] on setp 3: Reques,install or Assign Certficates.
i need your help!
Thanks!

Agree with Jason.
On the Certificate Request File page, type the full path and file name to which the request is to be saved.
After you get Certificate Request File, you need to submit this file to your CA (by email or other method supported by your organization for your enterprise CA) and, when you receive the response file, copy the new certificate to this computer so that it
is available for import.
Check how to set up certificates for the internal edge interface at
http://technet.microsoft.com/en-us/library/gg412750.aspx.
Check how to set up certificates for the external edge interface
http://technet.microsoft.com/en-us/library/gg398409.aspx.
Lisa Zheng
TechNet Community Support

SAN certificate for external access for edge server and reverse proxy

Hello
I have a question related to the certificate planning for LYNC 2013 EDGE SERVER .
For external access and mobile user's , Iwant to enable all the feature for external user's .
im planning to purchase san certificate ,
my first question do I need only one SAN for both my edge server and the reverse proxy ?
my second question about the name's that shoud be added to the certificate ?
sip.mydomain.com
av.mydomain.com
webconf.mydomain.com
what else I should add ? I want to add the names for all feature access.
Kind Regards
MK

Your Front End Pool should only contain front end servers, does it also contain your edge and back end? If so, this is a misconfiguration.
If you're planning to implement high availability, you'll want a different internal web services FQDN name than your pool name (unless you load balance the entire pool with a hardware load balancer).
You'll want your external web services FQDN to be different from your pool name if you want to use the mobile client on the internal network. Once you've come up with a new and otherwise unused FQDN for this purpose, you'll want that as additional
SAN on your cert.
Since you're not using this for the internal certificate, you can also pull admin.mydomain.com and LYNC2013-FE.mydomain.com off of the cert as those are needed internally only.
Lyncdiscoverinternal you can leave on if you need your internal mobile clients to not throw certificate errors because they don't trust your internal certificate authority, but this name would then need to be pointed to a reverse proxy or something that
can present the third party certificate.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications
This forum post is based upon my personal experience and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Lync Edge Server External Private Certificate

Hey GURUS!
Please help me out:
I'm having issues accessing Lync from external network.
Mobile clients login fine, but computer clients fail to login.
My current deployment consists in a single 2013 front-end and a single 2013 edge server.
All servers have certificates from my internal CA.
All servers have the root CA certificate installed in the trusted root certificate authority.
I have 2 sip domains, and the edge certificate has both sip domains.
However, when I test from test connectivity.microsoft.com, I get an error regarding the certificate chain.
I can't understand why lync requires a intermediate certificate, if I don't have any published in my organisation.
The certificate path goes: Root CA -> Certificate.
Also, the lync discover test runs with no errors what so ever.
This error on the edge didn't occur when I had lync 2010 running.
Does anyone know how to solve this?
Thanks!
Andrey Santana
edit: i forgot to upload the screenshot

Thiago,
The certificates from the Front End / Reverse Proxy are also from the internal CA and I don't get the error, it actually runs successfully.
Andrey
How did you test the certificates from the Front End and Reverse Proxy Server?
The public website connectivity.microsoft.com need a public certificate.
But if you use private certificate in lab, it could work as long as you install the Root CA certificate on client computer.
Lisa Zheng
TechNet Community Support

Can't assign certificate in Lync Edge Server

Hello, everyone
I've installed Lync Server, internally it works fine, but while i'm deploying edge server, i have a certificate problem. On request assign certificate step, I've issued by online certificate authority, after request i see following error:
The certificate has been issued by the online certification authority and is installed to the local certificate store, however it is not valid. Make sure that the Root certificate, and necessary certificate chain is installed on this server.
I've downloaded root certificate from CA and imported to trusted root certificate of edge server. I think root certificate is valid, because non domain members which imported root certificate, sign in Lync successfully.
I also sent offline certificate request (http://technet.microsoft.com/en-us/library/gg412750.aspx), importing certificate was successful. But there are no certificates in assign
certificate wizard. I checked personal certificates using mmc, there were certificates i have requested.
How can I solve this problem? Please help me!
Regards and thanks for any help :)
Enkhee

Hi,
You need to access htt://CAserver/certsrv to download the certificate chain in the edge server. Open MMC and install the Certificate chain with the following steps(To import the CA certification chain for the internal interface ):
http://technet.microsoft.com/en-us/library/gg412750.aspx
Check whether the Certificate chain is installed successfully in the
Trusted Root Certification Authorities.
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Can't Start Edge Services - Certificate Issue?

Similar to this
post, my edge services (a/v edge, web conferencing edge, etc) will not start with errors like 7023 and 7024. I went to the
Digicert Utility page linked in that post and if I enter sip.domain.com, I receive an error:
Certificate does not match name sip."domain".com
Subject
"edgeservername"."domain".com
Valid from 31/Jul/2012 to 31/Jul/2014
Issuer
"Internal CA Server"
SSL Certificate is not trusted
External Cert Info:
Subject: sip."domain".com
SANs: sip."domain".com, "edge server name"."domain".com, meet."domain".com, "av server"."domain".com, "wc server"."domain".com, dialin."domain".com
Let me know if more information about the cert or the edge server is needed. Thanks!

The two DigiCert High Assurance Root CA certificates should not be in the Personal Store, but installed in the "Trusted Root Certification Authorities". I would also recommend double checking the the Current User's personal certificate store .
Have you installed the DigiCert Utility on the Edge server and tested the certificates (https://www.digicert.com/util/)?
This tool checks the certificates from the perspective of the server.
The http://www.digicert.com/help/ site checks the certificates from the perspective of an external client. If the Utility is
showing the certificates are correct but the Help site still shows the error, make sure your sip.domain.com IP is pointing to the Edge Access IP and not the Reverse Proxy.
Please mark posts as answers/helpful if it answers your question.
Blog
Lync Validator - Used to assist in the validation and documentation of Lync Server 2013.

Wildcard Certifikate - Edge server/External web

Hello,
In our company we have deployed Lync 2013 CU4 with topology,
Edge server - One for all roles a/v
Front End - Standard with all roles
All certs are form our internal CA, and it works for my domain users. But for all external users or skype we need external cert. We have one wildcard cert for our domain.
So question is can we user wildcard cert for our Edge server, and exteranal serwis of front end.
Front end i think can use that is on tech net: http://technet.microsoft.com/en-us/library/gg398094.aspx

Good morning,
Using a wildcard certificate on Lync Edge server is not supported, and indeed will cause you problems.
It also sounds like you are passing your Lync web services directly to your front end server. This is not recommended, and you should use a reverse proxy for this purpose. You would then place an external (public) certificate on that reverse proxy. So there's
no need for a public cert on the front end in this scenario.
You may consolidate the certificate requirements for reverse proxy and Edge onto a single multi-san certificate, and use that same certificate on both servers.
OR
If you use two separate certificates then it is supported to use a wildcard public certificate on the reverse proxy (web services), but your Edge certificate must be a separate multi-san certificate.
Kind regards
Ben
Note: If you find a post informative, please mark it so using the arrow to the left. If it answers a question you've asked, please mark the thread as answered to aid others when they're looking for solutions to similar problems or queries.
For Fun: Gecko-Studio | For Work:
Nexus Open Systems

The client connection is not allowed on the internal edge of the Access Edge Server

We are trying to setup Lync 2013 Edge Server, we have a setup as described below
Real IPs for Lync Edge/WebConf/AV
NAT of real IPs through Firewall Juniper to FE IP
Topology with NAT (Firewall IP) IP enabled
Certificates for with SAN for sip.acme.com etc (Both certs are Client Server Auth Templates from Internal MS CA)(Trusted) on Edge
Route 192.215.0.0 255.255.255.0 gateway (=firewall internal ip address)
But when external user connects and we are tracing the connection we are getting below error and lync client is
not able to connect.
TL_INFO(TF_CONNECTION) [1]0AD8.0C30::09/07/2014-08:11:13.091.0000000f
(SIPStack,SIPAdminLog::WriteConnectionEvent:SIPAdminLog.cpp(454))[4150361027] $$begin_recordSeverity: information
Text: TLS negotiation started
Local-IP: 192.215.0.xxx:5061 (Edge IP)
Peer-IP: 192.215.0.xxx:1835 (Firewall IP)
Connection-ID: 0x1100
Transport: TLS
$$end_record
TL_ERROR(TF_CONNECTION) [0]0AD8.0638::09/07/2014-08:12:45.279.0000005d (SIPStack,SIPAdminLog::WriteConnectionEvent:SIPAdminLog.cpp(389))[4150360514] $$begin_record
Severity: error
Text: The client connection is not allowed on the internal edge of the Access Edge Server
Peer-IP: 192.xxx.0.xxx:1322 (firewall ip)
Transport: TLS
Result-Code: 0xc3e93d6b SIPPROXY_E_CONNECTION_INTERNAL_FROM_CLIENT
$$end_record

Hi pshetty,
Check the following blog to deploy your Edge Server:
http://jsilverdrake.blogspot.se/2012/04/publishing-lync-with-forefront-tmg-part_25.html
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make
sure that you completely understand the risk before retrieving any suggestions from the above link.
You need to create persistent static routes on the internal interface to all internal networks.
Regards,
Lisa Zheng
Lisa Zheng
TechNet Community Support

Exteral Users can't connect to the EDGE server

HI All for about a week and half now I've been seeing this error a lot on my event logs. All my external users are no longer able to connect to the DMZ EDGE server with 3 external IP's. They can only use LYNC if they access out VPN. Any suggestions on what
may be the issue???
Log Name:      Lync Server
Source:        LS Protocol Stack
Date:          4/24/2014 9:07:14 AM
Event ID:      14428
Task Category: (1001)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      LyncEdge.*********.net
Description:
TLS outgoing connection failures.
Over the past 16 minutes, Lync Server has experienced TLS outgoing connection failures 176 time(s). The error code of the last failure is 0x80090330(SEC_E_DECRYPT_FAILURE) while trying to connect to the server "**********.osis.is.local" at address
[10.111.111.8:5061], and the display name in the peer certificate is "Unavailable".
Cause: Most often a problem with the peer certificate or perhaps the host name (DNS) record used to reach the peer server. Target principal name is incorrect means that the peer certificate does not contain the name that the local server used to connect. Certificate
root not trusted error means that the peer certificate was issued by a remote CA that is not trusted by the local machine.
Resolution:
Check that the address and port matches the FQDN used to connect, and that the peer certificate contains this FQDN somewhere in its subject or SAN fields. If the FQDN refers to a DNS load balanced pool then check that all addresses returned by DNS refer to
a server in the same pool. For untrusted root errors, ensure that the remote CA certificate chain is installed locally. If you have already installed the remote CA certificate chain, then try rebooting the local machine.
Thanks Dave Wolf

Verify root certs exist in the Trusted Root Certification Store.
Also you can refer below links
http://www.shudnow.net/2011/02/01/lync-2010-edge-utilizing-windows-server-2008-r2-federation-tls-issues/
http://theucguru.blogspot.com/2012/03/lync-edge-ls-protocol-stack-14428.html
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"
Mai Ali | My blog: Technical

Lync 2013 client can't connect externally to edge server

So I have my edge server set up in the DMZ. 3 ips bound to an interface for external connectivity.
sip.domain.org (A record)
webconf.domain.org (A record)
av.domain.org (A record)
_sip.tls.domain.org:443 pointing to the same IP as sip.domain.org
External Lync Clients should be using this srv record to auto-connect, correct?
I have purchased a thawte ssl cert and bound it correctly to the external interface. Internal interface is a PKI internal CA cert. Sometimes when doing a testconnectivity from MS, it comes up stating " The certificate couldn't be validated because
SSL negotiation wasn't successful", when other times I run the test and it states that it validates the cert correctly, analyzing the cert - no problems found, etc, all looks good and then fails at "couldn't sign in Error Unknown (0x80131500)
Error type: TLSFailureException.
Not sure where to start looking or why it shows the cert is good sometimes and others not.
Also when I launch the Lync Server Admin Console, Under Topology, my edge server is showing Replication with a red X. Don't know what to look for either.

Hi jackl2001,
By default, no policies are configured to support external user access, including remote user access, federated user access, even if you have already enabled external user access
support for your organization. To control the use of external user access, you must configure one or more policies, specifying the type of external user access supported for each policy.
Click on the link below for more details.
Managing federation and external access to Lync Server 2013
http://technet.microsoft.com/en-us/library/gg520966.aspx
Best regards,
Eric

Edge Server Certficate does not match any of the supplied FQDNs

I'm having issues with a merged OCS 2007 R2 and Lync 2010 topology. I get a periodic event indicating there are Web conference connection issues betwen the Lync FEs and the OCS 2007 R2 Edge servers. Three times a minute the Edge server tries to connect to
the FE pool and the following events are generated:
Event ID: 41026
Lost connection to all Web Conferencing Edge Services
Event ID: 41024
Lost connection to all Web Conferencing Edge Services
Investigations show that IPv6 can be tha cause of this issue, but I don't think that is the case here. When I dig into the logs I see the following on the FE servers:
Certificate did not match any of the supplied fqdns Returned HRESULT=800B0109
This seems to be saying that the FE has a prequalified list of Edge server it can talk to and this certificate FQDN isn't on the list. I know you add an authorised list of FE servers to the Edge server, but I'm not aware of anywhere you add the edge
server FQDNs to the FEs other than for federation and media paths.
The certificate associated with the internal Edge interface is from a public provider and hence there is an Entrust chain to put in place on the edge server.
Jed

OK, whilst writing up the post it triggered me to go and check whether the FE server actaully trusts the certificate from the Edge server. I tried importing the certificate chain tied to the internal interface of the Edge server and placing it in the stores:
Personal (computer): Edge certificate
Intermediate Certificate Authorities (computer): PKI Provide intermediate certificate
Trusted Root certificate Authorities (computer): PKI provider root certificate
This immediatley fixed my issue. So, the event message is misleading as it doesn't say it doesn't trust the certificate but that is the root cause of my issues.
I completed this task on all my servers and on one server I noticed the issue was solved as soon as I imported the Edge certificate, it didn't need the intermediate or root certificate at all which surprised me. I repeated another test just pulling in the
root and intermediate certificate and that also fixed the issue. So, you can fix the prolem in two ways:
1) Import Edge certificate to personal computer store
2) Import Root and Intermediate to the appropriate stores
Jed

Edge server certificate

Similar Messages

Maybe you are looking for