Communication between the Communicator Phone Edition and Office Communications Server 2007 is by default encrypted using TLS and SRTP. Therefore the device needs to trust certificates presented by Communications Server 2007 servers. If you're using a well known Public Root CA (see table below), the certificate will automatically be trusted by the device.

If you're using your own private Root CA the device may or may not trust the certificate. Communicator Phone Edition will query AD for objects of category certificationAuthority (CN=Certification Authorities, CN=Public Key Services, CN=Services, CN=Configuration,  DC=<domain>, DC=<tld>). If the query does not return any object or if the objects have empty caCertificate attributes the device will search for AD objects of category pKIEnrollmentService.

If you deployed Windows Certificate Services on a domain member server, that server will probably be already published. If not, to have the Root CA certificate placed in the caCertificate attribute, use the following command:

Jens Trier Rasmussen has a nice blog post about this procedure.

But now imagine that you use a private certificate with a deep certificate path, how would you add the full certificate chain to AD?

I first came up with this problem recently, when I had to use a certificate from Saphety, a Portuguese public Certification Authority. Although Saphety certificates are generally trusted, since they are signed by ValiCert, this particularly long certification path (see figure below) was causing problems when used with Communicator Phone Edition. The symptoms were the same as if the certificate was not trusted.

The solution is to publish the whole certificate chain (both the Root CA and all subordinated CAs) in Active Directory. Here are the detailed steps:

1. Download the full certificate chain (.p7b file) and double click it
2. Expand the file name, select Certificates, right click each certificate on the right pane, select All Tasks and then Export...
   
3. Save each certificate as a .CER file.
   
4. Add the top level CA as a RootCA and all the others as SubCA, using the following commands:
   CertUtil -dsPublish -f www.valicert.com.cer RootCA
   CertUtil -dsPublish -f "RSA Public Root CA v1.cer" SubCA
   CertUtil -dsPublish -f "Saphety CA 01.cer" SubCA
   CertUtil -dsPublish -f "Saphety Server 01.cer" SubCA
   
5. Using ADSIEdit, verify that the objects were added under CN=Certification Authorities (CN=AIA for the Sub CAs), CN=Public Key Services, CN=Services, CN=Configuration,  DC=<domain>, DC=<tld>.
     
   

And that's it. Communicator Phone Edition should now be able to download the certificate from OCS and trust it. For more information, read Microsoft Communicator Phone Edition Deployment Guide.

Unified. Now.

This is the tagline for the Microsoft Unified Communications (UC) offer for FY'09. You may remember other taglines, such as "Unified. Simplified.", which was last year's tagline or "VoIP As You Are", Microsoft's approach to enterprise VoIP.

Each of these taglines represent Microsoft vision for Unified Communications, where presence is the heart of UC and software is the power that leverages complete communications across the applications and devices that people use every day.

As of today, this blog will be dedicated to Microsoft Unified Communications, covering technical aspects of the solution, news and announcements, tools, tips and personal experiences with all the UC products: Office Communications Server, Exchange Server, Office Communicator and Live Meeting.

My name is Rui Silva, I'm a Technology Solution Professional (TSP) - Core UC - at Microsoft and my status is "Available" to contribute for the technical community. Before joining Microsoft I was nominated MVP in Exchange Server for 3 years and I'm also the author of 3 other blogs: http://msmvps.com/blogs/ehlo, http://blogs.msexchange.org/silva and http://ehlo.blogspot.com (Portuguese).

Welcome to my new blog! Feedback is always welcome.