A single, shared certificate configured on the internal interface is used by the Access Edge, Web Conferencing, and A/V Edge server roles. The certificate must have a subject name that matches the internal FQDN of the server.

Tasks

  1. Download the CA Certification Path for the Internal Interface
  2. Import the CA Certification Path for the Internal Interface
  3. Verify That Your CA is in the List of Trusted Root CAs
  4. Create the Certificate Request for the Internal Interface
  5. Assign the Certificate for the Internal Interface

Download the CA Certification Path for the Internal Interface

Procedure W03-DWHO.37: To download the CA certification path for the internal interface

  1. Log on to OCSEDGEAV01 using the local Administrator account.

  2. Start Microsoft Internet Explorer and browse to http://pkiroot/certsrv. Enter the credentials for Fabrikam\Administrator.

  3. Under Select a task, select Download a CA certificate, certificate chain, or CRL, and then select Download CA certificate chain.

  4. Download and save the p7b file to the hard disk on the server.

Import the CA Certification Path for the Internal Interface

Procedure W03-DWHO.38: To import the CA certification path for the internal interface

  1. On OCSEDGEAV01, in the Deployment Wizard, on the Deploy Edge Server page, next to Step 4: Configure Certificates for the Edge Server, click Run to start the Communications Certificate Wizard.

  2. On the Available Certificate Tasks page, select Import a certificate chain from a .p7b file.

  3. On Import Certificate Chain page, type or browse to the full path and name of the .p7b file.

Verify That Your CA is in the List of Trusted Root CAs

Procedure W03-DWHO.39: To verify that your CA is in the list of trusted root CAs

  1. On OCSEDGEAV01, open the Microsoft Management Console (MMC) by running mmc.exe at a command prompt.

  2. On the File menu, select Add/Remove Snap-in.

  3. Add a certificate snap-in to manage certificate for the local computer (the computer this console is running on).

  4. In the console tree, expand Certificates (Local Computer), expand Trusted Root Certification Authorities, and then click Certificates.

  5. In the details pane, verify that your CA (for example, FabrikamCA) is on the list of trusted CAs.

Create the Certificate Request for the Internal Interface

Procedure W03-DWHO.40: To create the certificate request for the internal interface

  1. On OCSEDGEAV01, from the Office Communications Server 2007 deployment wizard, on the Deploy Edge Server page, next to Step 4: Configure Certificates for the Edge Server, click Run to start the Communications Certificate Wizard.

  2. On the Available Certificate Tasks page, select Create a new certificate.

  3. On the Select the Component for Which the Certificate Is Requested page, select only the Edge Server Private Interface check box.

  4. On the Delayed or Immediate Request page, select the Send the request immediately to an online certification authority check box.

  5. On the Name and Security Settings page, set the following information:

    • Name: OCSEDGEAV01.
    • Bit length: The bit length that you want to use for encryption. 1024 is recommended.
    • Ensure that the Mark cert as exportable check box is selected.

  6. On the Organization Information page, type or select the name of your organization (for example, Fabrikam) and organizational unit (for example, Hosting).

  7. On the Your Server's Subject Name page, do the following:

    • In Subject Name, verify that the server FQDN is displayed (for example, ocsedgeav01.fabrikam.com).
    • For this reference architecture, leave the Subject Alternate Name field blank.

  8. On the Geographical Information page, enter the Country/Region, State/Province and City/Locality. Do not use abbreviations.

  9. On the Choose a Certification Authority page, select specify the certificate authority that will be used to request this certificate, and then enter pkiroot.fabrikam.com\FabrikamCA.

  10. Enter the credentials for Fabrikam\administrator.

  11. Complete the Certificate Wizard. On the Certificates Wizard completed successfully page, click View and verify the certificate settings.

Assign the Certificate for the Internal Interface

Procedure W03-DWHO.41: To assign the certificate for the internal interface

  1. On OCSEDGEAV01, from the Office Communications Server 2007 deployment wizard, on the Deploy Edge Server page, next to Step 4: Configure Certificates for the Edge Server, click Run to start the Communications Certificate Wizard.

  2. On the Available Certificate Tasks page, select Assign an Existing Certificate.

  3. On the Available Certificates page, select the internal certificate for the edge server (for example, ocsedgeav01.fabrikam.com).

  4. On the Available Certificate Assignments page, select Edge Server Private.