Deploying Certificates for UM

Applies to: Exchange Server 2013

Topic Last Modified: 2013-02-22

You can use mutual Transport Layer Security (mutual TLS) to enable Unified Messaging (UM) to encrypt data sent from VoIP gateways, IP PBXs, and session border controllers (SBCs), or by Microsoft Lync Server. Certificates bind the identity of the certificate owner to a pair of electronic keys (public and private) that are used to encrypt and sign information digitally.

By default, when you install Unified Messaging, a self-signed certificate is created and used. This self-signed certificate can be used with VoIP gateways, IP PBXs, and SBCs, but not when you’re integrating UM with Lync Server. If you’re deploying certificates to be used with Lync Server, you need to obtain a certificate that was issued by an internal or PKI certification authority (CA) or purchase a commercial or third-party certificate that is mutually trusted by Unified Messaging and Lync Server.

Deploying certificates for VoIP gateways, IP PBXs, and SBCs

To enable UM to encrypt data that's sent between VoIP gateways, IP PBXs, and SBCs you need to do the following:

Use the self-signed UM certificate, or create a new Exchange certificate or a third-party commercial certificate that you can use for mutual TLS between UM and VoIP gateways, IP PBXs, and SBCs.
Import the certificate that will be used on all Client Access and Mailbox servers in your organization.
Enable the certificate to be used by UM services.
Import the certificate on your VoIP gateways, IP PBXs, and SBCs.
Configure the UM dial plan as SIP secured or Secured.
Configure the UM startup mode on Client Access and Mailbox servers in your organization.
Create the required UM IP gateways with a fully qualified domain name (FQDN).
Configure the listening port on the UM IP gateways to use TLS port 5061.
Restart the Unified Messaging Call Router service on all Client Access servers and restart the Microsoft Exchange Unified Messaging service on all Mailbox servers.

Deploying certificates for Lync Server

To encrypt data that's sent between UM and Lync Server, you need to do the following:

Create a new Exchange certificate or purchase a third-party commercial certificate. The certificate must be mutually trusted by UM and Lync Server.
Import the certificate that will be used on all Client Access and Mailbox servers in your organization.
Enable the certificate to be used by UM services.
Import the certificate on the computers running Lync Server.
Configure the SIP URI UM dial plan as SIP secured or Secured.
Configure the UM startup mode on Client Access and Mailbox servers in your organization.
Run OcsUmUtil.exe from a Lync Server computer.
Restart the Unified Messaging Call Router service on all Client Access servers and restart the Microsoft Exchange Unified Messaging service on all Mailbox servers in your organization. For details, see UM Services Procedures.
Restart the Lync Server Front-End service on all Lync Servers that are part of an Enterprise Edition Front End pool or restart the Standard Edition Front End Servers. You can use the Stop-CsWindowsService cmdlet to stop Lync Server services and the Start-CsWindowsService cmdlet to start Lync Server services.

The Start-CsWindowsService and Stop-CsWindowsService cmdlets are similar to the generic Windows PowerShell cmdlets Start-Service and Stop-Service. If you want, you could use the Start-Service or Stop-Service cmdlets to start and stop a Lync Server service. However, the Start-CsWindowsService Stop-CsWindowsService cmdlets include a ComputerName parameter that makes it easy to stop and start a Lync Server service on a remote computer. To do this, you include the ComputerName parameter followed by the fully qualified domain name (FQDN) of the remote computer. The Start-Service and Stop-Service cmdlets don’t have a comparable parameter.

Note:

To fully integrate UM and Lync Server, you must also run the ExchUcUtil.ps1 script on any Client Access or Mailbox server in your organization