3.3 Configure Certificates
Microsoft Office Communications Server 2007 and Microsoft Office Communications Server 2007 R2 will reach end of support on January 9, 2018. To stay supported, you will need to upgrade. For more information, see Resources to help you upgrade your Office 2007 servers and clients.
Office Communications Server requires certificates on each Standard Edition server in order to use MTLS (TLS with mutual authentication). All Office Communications Servers use MTLS to communicate with one another. If you do not configure MTLS on each server, users may be able to sign in to Office Communications Server, but presence and IM communications may not work properly.
Each client will also need to trust the certificate that the server is using in order to connect to the server by using TLS. You can use the Certificates Wizard on a Standard Edition server to do the following:
Request, create, and assign a new Web certificate with enhanced key usage for server authentication.
Assign an existing certificate.
You can use the same certificate for the Web Components Server, but the certificate for the Web Components Server must be assigned separately in IIS. You cannot use the Certificates Wizard to assign the certificate to the Web Components Server; instead, the certificate must be assigned by using Internet Information Services (IIS) Manager.
To configure a new certificate
Log on to your Standard Edition server as a member of the Administrators group and the RTCUniversalServerAdmins group. You must also have permission from your certificate authority to request a certificate.
Insert the Microsoft Office Communications Server 2007 CD. If you are installing from a network share, go to the \Setup\I386 folder, and then double-click setup.exe. The Deployment Tool will start automatically.
Click Deploy Standard Edition Server.
At Configure Certificate, click Run.
On the Welcome to the Certificate Wizard page, click Next.
On the Available Certificate Tasks page, click Create a new certificate, and then click Next.
On the Delayed or Immediate Request page, click Send the request immediately to an online certification authority, and then click Next.
On the Name and Security Settings page, do the following:
Under Name, enter a meaningful name for the certificate that this server will use for Office Communications Server communications.
Under Bit length, select the bit length that you want to use for encryption. A higher bit length is more secure, but it can degrade performance.
Clear the Mark cert as exportable check box.
When you are finished, click Next.
On the Organization Information page, type or select the name of your organization and organizational unit, and then click Next.
On the Your Server’s Subject Name page, do the following:
In Subject Name, verify that the server FQDN is displayed.
In Subject Alternate Name, verify that the required entries exist.
Note
SANs are required on your server for each supported SIP domain in the format sip.<domain> if all of the following are true:
Your organization supports multiple SIP domains.
Clients are using automatic configuration.
This server is the first server that clients connect to.
If you configured clients for automatic sign-in, the Certificate Wizard automatically added these SIP domains to the certificate request.
When you are finished, click Next.
On the Geographical Information page, enter the Country/Region, State/Province, and City/Locality. Do not use abbreviations. When you are finished, click Next.
On the Choose a Certification Authority page, the wizard attempts to automatically detect any CAs that are published in Active Directory. Do one of the following:
Click Select a certificate authority from the list detected in your environment, and then click your certification authority (CA).
Click Specify the certificate authority that will be used to request this certificate, and then type the name of your CA in the box in the format <CA_FQDN>\CA_instance> For example, CA.contoso.com\CAserver1. If you type the name of an external CA, a dialog box appears. Type the user name and password that you use for the external CA, and then click OK.
When you are finished, click Next.
On the Request Summary page, review the settings that you specified, and then click Next.
On the Certificates Wizard completed successfully page, click Assign.
A dialog box appears and informs you that the settings were applied successfully. Click OK.
Click Finish.
Submit this file to your CA (by e-mail or other method supported by your organization for your Enterprise CA). If your CA is configured for automatic approval, proceed to the next procedure. If your CA requires CA administrator approval to issue a certificate, the administrator must manually approve or deny the certificate issuance request on the issuing CA before you can assign it.
Configuring an Existing Certificate
To configure an existing certificate
Log on to your Standard Edition server with an account that is a member of the Administrators group and the RTCUniversalServerAdmins group and has permissions to request and assign a certificate from your certificate authority.
Insert the Microsoft Office Communications Server 2007 CD. If you are installing from a network share, go to the \Setup\I386 folder, and then double-click Setup.exe. The Deployment Tool will start automatically.
Click Deploy Standard Edition Server.
At Configure Certificate, click Run.
On the Welcome to the Certificate Wizard page, click Next.
On the Available Certificate Tasks page, click Assign an existing certificate, and then click Next.
On the Available Certificates page, click the certificate that you want to assign to the server, and then click Next.
On the Configure the Certificate(s) of your Server page, review the certificate assignments, and then click Next to assign the certificate.
Click Finish.
Assign the Web Components Server (IIS) Certificate
Assign the certificate to the Web Components Server by using the Internet Information Services (IIS) Manager.
To assign the certificate to the Web Components Server (IIS)
Log on to the server as a member of the Administrators group.
Click Start, click Control Panel, click Administrative Tools, and then click Computer Management.
Expand the Services and Applications node, and then expand the Internet Information Services (IIS) Manager node.
Expand the Web Sites node, right-click Default Web Site, and then click Properties.
Click the Directory Security tab.
Under Secure communications, click Server Certificate.
On the Welcome to the Web Server Certificate Wizard page, click Next.
Click Assign an existing certificate, and then click Next.
Select the certificate that you requested by using the Certificates Wizard, and then click Next.
On the SSL Port page, verify that port 443 will be used for SSL, and then click Next.
Review the certificate details, and then click Next to assign the certificate.
Click Finish to exit.
Click OK to close the Default Web Site Properties page.