Topic Last Modified: 2011-04-11

Microsoft Lync Server 2010 communications software supports the use of a single public certificate for access and web conferencing Edge external interfaces, plus the A/V Authentication Edge internal interface. The Edge internal interface typically uses a private certificate issued by an internal certification authority (CA), but can also use a public certificate, provided that it is from a trusted public CA. The reverse proxy in your deployment uses a public certificate and encrypts the communication from the reverse proxy to clients and the reverse proxy to internal servers by using HTTP (that is, Transport Layer Security over HTTP).

Following are the requirements for the public certificate used for access and web conferencing Edge external interfaces, and the A/V authentication Edge internal interface:

If you are deploying multiple, load-balanced Edge Servers at a site, the A/V Edge external certificate that is installed on each Edge Server must be from the same CA and must use the same private key. Note that the certificate's private key must be exportable, regardless of whether it is used on one Edge Server or many Edge Servers. It must also be exportable if you request the certificate from any computer other than the Edge Server.

Requirements for the private (or public) certificate used for the Edge internal interface are as follows:

If you are deploying multiple, load-balanced Edge Servers at a site, the A/V authentication certificate that is installed on each Edge Server must be from the same CA and must use the same private key. This means that the certificate must be exportable, if it is to be used on more than one Edge Server. It must also be exportable if you request the certificate from any computer other than the Edge Server.

The reverse proxy in your deployment services requests for:

The reverse proxy publishes the internal server Web Components URLs. The Web Components URLs are defined on the Director, Front End Server or Front End pool as the External web services in Topology Builder.

Wildcard entries are supported in the subject alternative name field of the certificate assigned to the reverse proxy. For details about how to configure the certificate request for the reverse proxy, see Request and Configure a Certificate for Your Reverse HTTP Proxy.