Click on the general tab and give the template a name e.g. Skype Server. Change the validity to a time frame of your choice e.g. 5 years Click on the Subject Name tab and change to Supply in Request Click on Cryptography and change the minimum key size to either 4096 or leave at 2048 Click on the Extensions tab and select Application Policies and press edit Remove Client Authentication from the list and press OK Click on the Security tab, and add all your Skype for Business computer accounts to the permission list. Select each computer object and enable Enrol and AutoEnrol Press OK. Back in your Certificate Authority, right click on certificate templates, new, certificate template to issue Find the certificate template you created and press OK Exit the Certificate Authority Internal Server Certificates Each Skype for Business server is required to have a valid SSL certificate installed from either a public or internal Certificate Authority. The certificate is used to secure and encrypt data transmissions across multiple Skype for Business workloads. Without a valid certificate Skype for Business services will not start. For internal servers that are not public facing it is recommended to use an internal Certificate Authority. This saves investment in public certificates and also makes the renewal process a lot simpler and quicker. Internal Certificates require the common name, or subject name as it is also referred to match the Skype for Business pool FQDN, followed by additional Subject Alternative Names (SANs) for each service the server provides and the server’s FQDN. The following tables list the standard certificate requirements for each server role. However, as this will be personalized to your environment, you should revert to your Low Level Design for accurate information. Front End and Director Servers Front End and Director Server Internal Certificates Property Value Common Name Poolname.hostedhouse.co.uk Algorithm SHA 256 Subject Alternative Names Poolname.hostedhouse.co.uk Lyncdiscoverinternal.hostedhouse.co.uk Meet.hostedhouse.co.uk Dialin.hostedhouse.co.uk
Click on the general tab and give the template a name e.g. Skype Server. Change the validity to a time frame of your choice e.g. 5 years Click on the Subject Name tab and change to Supply in Request Click on Cryptography and change the minimum key size to either 4096 or leave at 2048 Click on the Extensions tab and select Application Policies and press edit Remove Client Authentication from the list and press OK Click on the Security tab, and add all your Skype for Business computer accounts to the permission list. Select each computer object and enable Enrol and AutoEnrol Press OK. Back in your Certificate Authority, right click on certificate templates, new, certificate template to issue Find the certificate template you created and press OK Exit the Certificate Authority Internal Server Certificates Each Skype for Business server is required to have a valid SSL certificate installed from either a public or internal Certificate Authority. The certificate is used to secure and encrypt data transmissions across multiple Skype for Business workloads. Without a valid certificate Skype for Business services will not start. For internal servers that are not public facing it is recommended to use an internal Certificate Authority. This saves investment in public certificates and also makes the renewal process a lot simpler and quicker. Internal Certificates require the common name, or subject name as it is also referred to match the Skype for Business pool FQDN, followed by additional Subject Alternative Names (SANs) for each service the server provides and the server’s FQDN. The following tables list the standard certificate requirements for each server role. However, as this will be personalized to your environment, you should revert to your Low Level Design for accurate information. Front End and Director Servers Front End and Director Server Internal Certificates Property Value Common Name Poolname.hostedhouse.co.uk Algorithm SHA 256 Subject Alternative Names Poolname.hostedhouse.co.uk Lyncdiscoverinternal.hostedhouse.co.uk Meet.hostedhouse.co.uk Dialin.hostedhouse.co.uk