Topic Last Modified: 2011-03-25

Microsoft Lync Server 2010 relies on certificates for server authentication and to establish a chain of trust between clients and servers and among the different server roles. The Windows Server 2008, Windows Server 2008 R2, and Windows Server 2003 public key infrastructure (PKI) provides the infrastructure for establishing and validating this chain of trust.

Certificates are digital IDs. They identify a server by name and specify its properties. To ensure that the information on a certificate is valid, the certificate must be issued by a CA that is trusted by clients or other servers that connect to the server. If the server connects only with other clients and servers on a private network, the CA can be an enterprise CA. If the server interacts with entities outside the private network, a public CA might be required.

Even if the information on the certificate is valid, there must be some way to verify that the server presenting the certificate is actually the one represented by the certificate. This is where the Windows PKI comes in.

Each certificate is linked to a public key. The server named on the certificate holds a corresponding private key that only it knows. A connecting client or server uses the public key to encrypt a random piece of information and sends it to the server. If the server decrypts the information and returns it as plain text, the connecting entity can be sure that the server holds the private key to the certificate and therefore is the server named on the certificate.

Note: Not all public CAs comply with the requirements of Lync Server 2010 certificates. It is recommended to refer to the listing of certified Public CA vendors for your public certificate needs. For details, see Unified Communications Certificate Partners for Exchange 2007 and for Communications Server 2007 at http://go.microsoft.com/fwlink/?LinkId=140898.

CRL Distribution Points

Enhanced Key Usage