[This is pre-release documentation and subject to change in future releases. This topic's current status is: Milestone-Ready]

Topic Last Modified: 2010-06-22

If you have deployed Exchange Unified Messaging (UM), as described in Exchange Unified Messaging Integration, to provide Exchange UM features to Enterprise Voice users in your organization, use the following procedures to configure the certificate on the server running Exchange UM.

Important:
For internal certificates, both the servers running Microsoft Communications Server 2010 and the servers running Microsoft Exchange must trust the same certification authority (CA).

The Exchange Server must be configured with a server certificate in order to connect to Communications Server:

  1. Download the CA certificate for the Exchange Server.

  2. Install the CA certificate for the Exchange Server.

  3. Verify that the CA is in the list of trusted root CAs of the Exchange Server.

  4. Create a certificate request for the Exchange Server and install the certificate.

  5. Assign the certificate for the Exchange Server.

To download the CA certificate

  1. On the server running Exchange UM, click Start, click Run, type http://<name of your Issuing CA Server>/certsrv, and then click OK.

  2. Under Select a task, click Download a CA certificate, certificate chain, or CRL.

  3. Under Download a CA Certificate, Certificate Chain, or CRL, select Encoding Method to Base 64 and click Download CA certificate.

    Note:
    You can also specify DER encoding at this step. If you select DER encoding, the file type in the next step of this procedure and in step 10 of To Install the CA certificate is .p7b rather than .cer.

  4. In the File Download dialog box, click Save, and then save the file to the hard disk on the server. (The file will have either a .cer or a .p7b file extension, depending on the encoding that you selected in the previous step.)

To install the CA certificate

  1. On the server running Exchange UM, open Microsoft Management Console (MMC) by clicking Start, clicking Run, typing mmc in the Open box, and then clicking OK.

  2. On the File menu, click Add/Remove Snap-in, and then click Add.

  3. In the Add Standalone Snap-ins box, click Certificates, and then click Add.

  4. In the Certificate snap-in dialog box, click Computer account, and then click Next.

  5. In the Select Computer dialog box, ensure that the Local computer: (the computer this console is running on) check box is selected, and then click Finish.

  6. Click Close, and then click OK.

  7. In the console tree, expand Certificates (Local Computer), expand Trusted Root Certification Authorities, and then click Certificates.

  8. Right-click Certificates, click All Tasks, and click Import.

  9. Click Next.

  10. Click Browse to locate the file, and then click Next. (The file will have either a .cer or a .p7b file extension, depending on the encoding that you selected in step 3 of To download the CA certificate.

  11. Click Place All Certificates in the following store.

  12. Click Browse, and then select Trusted Root Certification Authorities.

  13. Click Next to verify the settings, and then click Finish.

To verify that the CA is in the list of trusted root CAs

  1. On the server running Exchange UM, in MMC expand Certificates (Local Computer), expand Trusted Root Certification Authorities, and then click Certificates.

  2. In the details pane, verify that your CA is on the list of trusted CAs.

To create a certificate request and install the certificate on Exchange Server 2007 (SP1)

  1. On the server running Exchange UM, click Start, click Run, type http://<name of your Issuing CA Server>/certsrv, and then click OK.

  2. Under Select a task, click Request a Certificate.

  3. Under Request a Certificate, click Advanced certificate request.

  4. Under Advanced Certificate Request, click Create and submit a request to this CA.

  5. Under Advanced Certificate Request, select Web server or another server certificate template configured for server authentication.

  6. Under Identifying Information for Offline Template, in the Name box, type the FQDN of the Exchange Server.

    Note:
    You must enter the FQDN of the Exchange Server for communications to work.

  7. Under Key Options, click the Store certificate in the local computer certificate store check box.

  8. Click the Submit button in the bottom of the Web page.

  9. In the dialog box that opens asking for confirmation, click Yes.

  10. On the Certificate Issued page, under Certificate Issued, click Install this certificate.

  11. In the dialog box that opens asking for confirmation, click Yes.

  12. Verify that the message "Your new certificate has been successfully installed" appears.

To create a certificate on Exchange Server 2010

  1. Log on to the server running Exchange UM with appropriate permissions. See http://go.microsoft.com/fwlink/?LinkId=195499 for details.

  2. Refer to either of the following procedures to create the certificate:

    1. http://go.microsoft.com/fwlink/?LinkId=195494

    2. http://go.microsoft.com/fwlink/?LinkId=195496

    Note:
    For the certificate Subject Name, you must enter the FQDN of the Exchange Server for communications to work.

To assign the certificate on Exchange Server 2007 (SP1)

  1. On the server running Exchange UM, open MMC.

  2. In the console tree, expand Personal and then click Certificates.

  3. In the details pane, verify that personal certificate is displayed.

  4. Double click the certificate to read its details and ensure it is valid.

    Note:
    It may take a few minutes before the certificate displays as valid.

  5. Restart the Microsoft Exchange Unified Messaging service.

    Note:
    The server running Exchange Server 2007 SP1 Unified Messaging automatically retrieves the correct certificate.

  6. Open Event Viewer and look for Event ID 1112, which specifies what certificate the server running Exchange Server 2007 SP1 Unified Messaging has retrieved.

To assign the certificate on Exchange Server 2010

  1. Log on to the server running Exchange UM with appropriate permissions. See http://go.microsoft.com/fwlink/?LinkId=195499 for details.

  2. See http://go.microsoft.com/fwlink/?LinkId=195497 for the procedure to assign the certificate.