TLS and MTLS

Microsoft Office Communications Server 2007 and Microsoft Office Communications Server 2007 R2 will reach end of support on January 9, 2018. To stay supported, you will need to upgrade. For more information, see Resources to help you upgrade your Office 2007 servers and clients.

The TLS (Transport Layer Security) and MTLS (Mutual Transport Layer Security) protocols provide encrypted communications and endpoint authentication on the Internet. Office Communications Server uses these two protocols to create its network of trusted servers and to ensure that all communications over that network are encrypted. All SIP communications between servers occur over MTLS. SIP communications from client to server occur over TLS.

TLS enables users, through their client software, to authenticate the Office Communications Server 2007 servers to which they connect. On a TLS connection, the client requests a valid certificate from the server. To be valid, the certificate must have been issued by a CA that is also trusted by the client and the DNS name of the server must match the DNS name on the certificate. If the certificate is valid, the client trusts the server and opens the connection. The resulting connection is trusted and from that point is not challenged by other trusted servers or clients.

Server-to-server connections rely on MTLS for mutual authentication. On an MTLS connection, the server originating a message and the server receiving it exchange certificates from a mutually trusted CA. The certificates prove the identity of each server to the other. In Office Communications Server 2007 deployments, certificates issued by the enterprise CA are automatically considered to be valid by all internal clients and servers. In federated scenarios, the issuing CA must be trusted by both federated partners. Each partner can use a different CA, if desired, so long as that CA is also trusted by the other partner.

TLS and MTLS help prevent both eavesdropping and man-in-the middle attacks. In a man-in-the-middle attack, the attacker reroutes communications between two network entities through the attacker's computer without the knowledge of either party. TLS and secure server lists mitigate the risk of a man-in-the middle attack partially on the application layer, but ultimately the networking infrastructure (in this case corporate DNS) must be secured according to best practices. Office Communications Server assumes that the DNS server is trusted in the same way that domain controllers and global catalogs are trusted.

The following figure shows how Office Communications Server uses MTLS to create a network of trusted servers.

Figure 1. Trusted connections in a Communications Server 2007 network