Certificates are one of those elements that you deal with in your initial install and then forget about them until they expire…or until Microsoft releases the mobility functionality and you add a SAN to your public cert.
In my case I didn’t re-key the cert (initially), I thought I’d try adding the SAN lyncdiscovery.myco.com from the Lync Deployment Wizard in my Standard Edition Server. It was only once I had submitted the request and downloaded the updated certificate from the public CA (Go Daddy) that I discovered the Private Key was missing.
Probably obvious to most, but I am no certificate Guru J
Probably obvious to most, but I am no certificate Guru J
A little digging helped me recall that the Private Key can only be exported with the cert from the server that initially requested the cert (i.e. the server that generated the CSR). Since the certificate I was using was initially requested from the Edge server I had no chance of getting the Private Key.
How to get the Certificate with the Private Key
1. Requested a new certificate from the Edge server (in my case) using the Lync Deployment Wizard
2. Copy the CSR text, log into the Public CA (GoDaddy in my case) and select Re Key.
3. Download the cert from Public CA.
4. Import the certificate you downloaded into the Personal Store on the Edge server.
5. Export the cert BUT since this is the server that initially generated the request you will be able to check the box for exporting the Private Key as well.
6. Once the cert has been exported with the Private key you can use it on multiple servers.
Note from the Peanut Gallery
When assigning a Lync Certificate from the wizard you will only have visibility of certificates that are actually already in the personal store AND have their Private Key atatched.
PB
