renew lync 2013 edge internal certificate

See Part I, Part II, Part III and Part IV for step by step process.

Once you are done with Edge server installation you can request a certificate.

Edge server need two different types of certificates one for internal and another for external.

For internal certificate you can use internal CA while for external certificate you can generate the request and send it to your external CA to get the public certificate.

Follow the step by step process to request and assign the certificates.

Once you receive the certificate then Import and assign the certificate.

As far as I know the public certificate issuers dont care about templates as you select the type of cert you want to have beforehand.

And with the recent release of the new Lync Mobility service and mobile clients there will be a lot of new certificate requests performed in order to add the new Autodiscover name.

But this approach is limited in what options can be modified so when dealing with Subject Alternative Name fields and third-party or offline Certificate Authorities there is an even easier way.

This tool makes it a snap to copy an existing certificate and quickly make a change to either name fields, organization fields, or the key size.

This tool works with any CA, private or public for standard SSL certificates with or without SAN entries.

The reason that the Lync Certificate Wizard is recommended as it should properly populate the required names for the desired server role(s) as well as automatically proceed to assign the certificate to the services.

This package is the actual application and not an installation package so just drop it on the desktop for quick access.

Select Yes in the following pop-up window to copy the current attributes from the highlighted certificate.

This is as another illustration to help understand what the hashed text actually means.

If a certificate template is request choose the Web Server template or whatever template is closest as possible, depending on the specific CA.

It is important is understand that the initial request on the Lync server (using the DigiCert utility) created a unique private key that is temporarily stored on the server which is useless until it can be married to the public key which the issuing CA will have created.

The.cer file includes this public key and by importing this file into the proper server it will be able to join the two files together to create a fully functioning X.509 certificate capable of both encrypting and decrypting data.

In the Import Certificate Wizard window locate the certificate file which was provided by the issuing CA (e.g.

Next.

This is expected as the import has not actually yet been performed which further illustrates that the certificate file itself is useless until the import process is completed.

A message reporting a successful import should be reported along with a reminder to assign the certificate to something.

The Test Key button can also be used to test the validity of the new certificate.

Before assigning the certificate it is important to first verify which roles on t he Lync server are using what certificate as various configuration scenarios are supported and there might actually be one or more certificates in use across different usages.

In this scenario all three usages ( Default, WebServicesInternal, and WebServicesExternal ) are assigned to the same SAN certificate.

Notice that the same exact thumbprint value is listed for all three Use types.

Copy the edited string to the clipboard to be used in the next step.

This a recommended step on any Lync Edge server regardless of what CA was used to issue its own certificates as an unrepaired Edge server can experience communications issues with other federated Lync organizations which may be using certain DigiCert certificates.

Thought you might be interested to know that besides our CSR Cert Decoder, we also have an SSL Checker.

You can use it to carry out several checks on internet facing certificates.

It will warn if the hostname doesnt match the CN or a SAN in the cert, check for weak keys, check for weak algorithms, check if trusted or not, etc.

It will also fully decode the certificate to show all the details including any SANS.

Renew Lync 2013 Edge Internal Certificate