Today I’d like to talk about certificates and a problem that seems to be becoming more and more common with Lync Phone Edition. The problem is that Lync Phone Edition devices that are tethered receive the message “Connection to Microsoft Exchange is unavailable. Please contact your support team”.
The most common cause of this error I have seen is having the Lync pool certificates issued from a different Certificate Authority (CA) than the Exchange server certificates. This problem has become more and more common as organizations move to using certificates from Public CA on their Exchange servers internally. The root of the problem is the Lync Phone Edition devices will not trust a CA other than the one that issued the certificate to the Lync pool it is connecting to.
To reproduce this issue I have configured a lab environment as follows:
Lync Environment:
- Enterprise Edition Pool: lyncpool.lyncguys.com
- Certificate Issued By: Internal Certificate Authority (Lyncguys-LG-DC-CA)
- Common Name: Pool FQDN (lyncpool.lyncguys.com)
Exchange Environment
- Single Exchange 2010 Server: LG-Ex.lyncguys.com
- Public and DNS name: mail.lyncguys.com
- Certificate Issued By: DigiCert
- Common Name: Mail.lyncguys.com
I created a test account (kevin@lyncguys.com) and signed in via a tethered CX600 (Aries) phone. As expected, I immediately saw the error when I tried to access the calendar.
*Note – A Lync Phone Edition device (other than CX700/Tanjay) will require the tethered connection between the PC/Laptop and phone to authenticate to Exchange and view the calendar. Exchange does not support Pin Auth currently, so this article does not apply to devices that are not tethered.
To work around the limitation in Lync Phone Edition there is a Lync Management Shell command that will allow you to add the public providers root certificate to the Web Services Configuration on the Lync servers. The command requires you to know the “thumbprint” from the root certificate.
To find the thumbprint, open Outlook Web Access (OWA) from an internet browser, click on the “Lock” icon in the browser and choose “View Certificates”:
The certificate your Exchange server is using will be displayed:
Next, click on the “Certification Path” tab at the top of the certificate window, click on the top certificate in the list and choose “View Certificate”.
Now click on the “Details” tab and scroll down to “Thumbprint”. Highlight the thumbprint and press CTRL+C to copy it to your clipboard.
Open notepad or another text editor and paste the thumbprint into the editor. Next, remove all spaces from the thumbprint as shown in the screen shot below.
Take the thumbprint without any spaces and copy it into the command below, then run the command from Lync Management Shell:
$cert = new-cswebtrustedCACertificate -thumbprint “Thumbprint_Here” -castore TrustedRootCA
i.e:
Verify that pasting the command into the Lync Management Shell did not add a “?” to the beginning of your command (shown below):
Now that the certificate information has been stored as a variable ($cert), run the following command to add the certificate to the Web Service Configuration for the Lync servers:
set-cswebserviceConfiguration -trustedCACerts @{Add=$cert}
To verify the command completed successfully run the command:
Get-CSWebServiceConfiguration, the thumbprint of the newly added certificate will appear in the “TrustedCACerts” list.
After this process is complete, reboot the Lync Phone Edition devices and verify the calendar is functional.
*Tip – In my lab the intermediate certificates for DigiCert were not installed correctly on the Exchange server causing the error to still display. To correct this issue download the DigiCert Certificate Utility and run it on all Exchange servers in the CAS array to verify the certificate chain is installed correctly. *
One other thing to note, there is no command to remove a single certificate from the “TrustedCACerts list in the Lync Web Services Configuration. However, you can use the replace option with the Set-CSWebServiceConfiguration command to add a new CA Certificate to the store and remove all others.
i.e.
$cert = new-cswebtrustedCACertificate -thumbprint “Thumbprint_Here” -castore TrustedRootCA
set-cswebserviceConfiguration -trustedCACerts @{Replace=$cert}
If you need to remove all CA Certificates from the store and would not like to use a new one, you can use the command “Remove-CSWebServiceConfiguration” which will set all of the Web Service Configuration back to default. This will remove all configured settings for the Web Service Configuration, so if you have modified any other settings, you will have to update them again after running this command.
H/T to My co-worker Randy Wintle for his help tracking this down
Hope this helps!
