Certificates

Microsoft announced some Office 365 certificate changes last year: https://learn.microsoft.com/en-us/microsoft-365/compliance/encryption-office-365-tls-certificates-changes?view=o365-worldwide If you’re using Microsoft Teams Direct Routing you need to apply a new root certificate to your SBCs. More specifically if your SBC has “TLS Mutual Authentication” enabled on the Teams SIP interface then you MUST make this change. I would recommend making this change anyway and ASAP! How to check if TLS Mutual Authentication is enabled? Log into your AudioCodes SBC, navigate to Setup > Signalling and Media > Core Entities > SIP Interfaces. ...

I recently came across an issue with Lync 2013 where SCOM (System Center Operations Manager) was periodically reporting errors with the Conferencing Attendant and IM MCU. The SCOM errors were as follows: Alert: [LYNC] Conferencing Attendant failed to join the conference. Source: LS Conferencing Auto Attendant Component [F05.DOMAIN.LOCAL] Path: FE05.DOMAIN.LOCAL Last modified by: System Last modified time: 4/11/2016 11:01:50 AM Alert description: Conferencing Attendant failed to join the conference. Microsoft.Rtc.Signaling.ConnectionFailureException:Operation failed because the network connection was not available. ---> Microsoft.Rtc.Internal.Sip.TLSException: TLS Negotiation took too long to complete Alert: [LYNC] Lync Server IM MCU failed to connect to the SIP Front End. Source: LS Instant Message Conferencing Component [FE03.DOMAIN.LOCAL] Path: FE03.DOMAIN.LOCAL Last modified by: System Last modified time: 4/11/2016 11:35:24 AM Alert description: Lync Server IM MCU failed to connect to the SIP Front End. Local Machine name: FE03.DOMAIN.LOCAL FE hostname: FE06.DOMAIN.LOCAL IP address: 10.10.10.13:5061 Message: TLS Negotiation took too long to complete Strangely, no users had reported issues and initial thoughts were performance problems with the Lync Front End servers. This is quite a large Pool with 7 Front Ends and each Front End would periodically generate the above errors in SCOM. All servers were running the latest CU and all certificates were valid for 2 years. ...

When you deploy Lync and assign internal certificates to your Lync servers (E.g. Front End, Internal Edge, SBA and Gateways) by default you will only have a 2 year certificate from the “Web Server” template. I like to create a new Certificate Template for Lync with a 5 year lifespan as it can be quite annoying having to renew certificates, especially on the Edge servers and Gateways where you have to export the cert request. I have tried creating a 10 year Certificate Template but the Lync Deployment Wizard complains that the cert is valid for over 5 years. It’s also a good idea to set your Certificate Authority validity period to a long period, I usually opt for 20/25 years. This article will cover how to create a 5 year Certificate Template for Lync. By assigning Certificates to your Lync servers with a longer validity period you won’t have to renew them as often. ...