• Article

Obtaining Certificates for Group Chat Server

Topic Last Modified: 2010-04-14

You must have a certificate issued by the same certification authority (CA) as the one used by Office Communications Server 2007 R2 internal servers for each server running Lookup service, Channel service, Web service, and Compliance service. Obtain the required certificate(s) before you start Microsoft Office Communications Server 2007 R2 Group Chat, especially if you are using an external CA.

You can use the procedures in this topic to obtain a certificate by using an internal enterprise CA and Certificate Services.

To download the CA certification path

  1. With your Enterprise root CA offline and your Enterprise subordinate (issuing) CA server online, sign in to your Group Chat Server by clicking Start, clicking Run, typing http://<name of your Issuing CA Server>/certsrv, and then clicking OK.

  2. In the Select a task box, click Download a CA certificate, certificate chain, or CRL.

  3. In Download a CA Certificate, Certificate Chain, or CRL, click Download CA certificate chain.

  4. In the File Download dialog box, click Save.

  5. Save the .p7b file on a drive on your server. If you open this .p7b file, the chain contains the following two certificates:

    • <name of Enterprise root CA> certificate
    • <name of Enterprise subordinate CA> certificate

To install the CA certification path

  1. Click Start, click Run, type mmc, and then click OK.

  2. On the File menu, click Add/Remove Snap-in.

  3. In the Add/Remove Snap-in dialog box, click Add.

  4. On the Available Standalone Snap-ins list, click Certificates, and then click Add.

  5. Click Computer account, and then click Next.

  6. In the Select Computer dialog box, click Local computer (the computer this console is running on), and then click Finish.

  7. Click Close, and then click OK.

  8. In the console tree of the Certificates snap-in, expand Certificates (Local Computer).

  9. Expand Trusted Root Certification Authorities.

  10. Right-click Certificates, point to All Tasks, and then click Import.

  11. In the Import Wizard, click Next.

  12. Click Browse, navigate to where you saved the certification chain, click the p7b file, and then click Open.

  13. Click Next.

  14. Accept the default value Place all certificates in the following store and verify that Trusted Root Certification Authorities appears under the Certificate store.

  15. Click Next.

  16. Click Finish.

To request a certificate

  1. Open a Web browser, type http://<name of your Issuing CA server>/certsrv, and then press ENTER.

  2. Click Request a Certificate.

  3. Click Advanced certificate request.

  4. Click Create and submit a request to this CA.

  5. In Certificate Template, select the Web server template.

  6. In Identifying Information for Offline Template, in Name, type the fully qualified domain name (FQDN) of the server.

  7. In Key Options, in CSP, click Microsoft RSA SChannel Cryptographic Provider.

  8. Select the Store certificate in the local computer check box.

  9. Click Submit.

  10. In the Potential Scripting Violation dialog box, click Yes.

To install the certificate on the computer

  1. Click Install this certificate.

  2. In the Potential Scripting Violation dialog box, click Yes.

To manually approve a certificate issuance request after the request is made

  1. Log on as a member of the Domain Admins group to the Enterprise subordinate CA server.

  2. Click Start, click Run, type mmc, and then press ENTER.

  3. On the File menu, click Add/Remove Snap-in.

  4. Click Add.

  5. In Add Standalone Snap-in, click Certification Authority, and then click Add.

  6. In Certification Authority, click Local computer (the computer this console is running on).

  7. Click Finish.

  8. Click Close, and then click OK.

  9. In the Microsoft Management Console (MMC), expand Certification Authority, and then expand your issuing certificate server.

  10. Click Pending request.

  11. In the details pane, right-click the request identified by its request ID, point to All Tasks, and then click Issue.

  12. On the server from which you requested the certificate, click Start, and then click Run.

  13. Type http://<name of your Issuing CA Server>/certsrv, and then click OK.

  14. In the Select a task box, click View the status of a pending certificate request.

  15. In the View the Status of a Pending Certificate Request, click your request.

  16. Click Install this certificate.

    Verify that the certification authority (CA) certificate chain that grants trust for certificates issued from your CA has been installed at the following location: console root/certificates (local computer)/trusted root certificate authorities/certificates. This chain contains the Root CA certificate.