- Remove From My Forums
-
Question
-
I have a problem with my Office Communicator on several machines.
I have in my lab here:
1 Windows 7 Machine
3 Windows XP Machines
All belong to the let’s say abc.com domain. I have a single Active Directory Network. All units are logged in by me the administrator.
I attempt to login to Office Communicator with Test users that I have created. On the windows 7 machine. I connect just fine.
on 1 of the Windows XP machines, I connect just fine. But the other 2 xp machines will not connect stating that there is a problem verifying the certificate from the server.
I have reviewed the posts here and have tried all of the recommendations including exporting the key and importing it into the machine. However…this has not solved my issue.
Why can I connect to the OCS from two of the machines, but not the other two? All of the XP machines are the same software levels, have all the same Windows Updates and are Identical Images as I currently run an image server.
So what am I missing?
I greatly appreciate any help!
Thanks
Lost in OCS!
Answers
-
I have fixed my issue for now. It seems as though all my clients are not auto-enrolling the cert. I have created the https:// domain / certsrv and was able to connect. I will mark this is complete for now!
Will have to focus on the auto-enrollment later!
-
Marked as answer by
Friday, November 12, 2010 3:28 AM
-
Marked as answer by
- Remove From My Forums
-
Question
-
I have a problem with my Office Communicator on several machines.
I have in my lab here:
1 Windows 7 Machine
3 Windows XP Machines
All belong to the let’s say abc.com domain. I have a single Active Directory Network. All units are logged in by me the administrator.
I attempt to login to Office Communicator with Test users that I have created. On the windows 7 machine. I connect just fine.
on 1 of the Windows XP machines, I connect just fine. But the other 2 xp machines will not connect stating that there is a problem verifying the certificate from the server.
I have reviewed the posts here and have tried all of the recommendations including exporting the key and importing it into the machine. However…this has not solved my issue.
Why can I connect to the OCS from two of the machines, but not the other two? All of the XP machines are the same software levels, have all the same Windows Updates and are Identical Images as I currently run an image server.
So what am I missing?
I greatly appreciate any help!
Thanks
Lost in OCS!
Answers
-
I have fixed my issue for now. It seems as though all my clients are not auto-enrolling the cert. I have created the https:// domain / certsrv and was able to connect. I will mark this is complete for now!
Will have to focus on the auto-enrollment later!
-
Marked as answer by
Friday, November 12, 2010 3:28 AM
-
Marked as answer by
- Remove From My Forums
-
Question
-
Hi,
I’ve installed Office communitation server on a wondows 2003 enterprise server (32 bit), to give you a background of the setup, I have a PDC with Win 2K3 x64, Test server 1 which acts as a Additional domain controller, and runs Exchange 2003, (configured with Outlook web access and successfully running). This Test server 1 also has OCS 2007 running and configured with Communicator Web Access. Test Server 2, is also configured as an additional domain controller, and configured as an Edge Server.
The Problem:
With Test server 1 configured as the Communicator Web access server, I am able to Use either Web access or Office communicator. If I Use TCP, then i can use communicator and web access gives me an error. If i use TLS, then Web Access works fine but Communicator Gives me an error stating ‘There was a problem Verifying the Certificate from the Server’. I Used an Internal Root CA (configured in Test Server 1) and the Subject Name was given as ocs.testdomain.com.
I’m a little confused. Any help would be appreciated.
Thanks.
Naveen
- Remove From My Forums
-
Question
-
Hi,
I’ve installed Office communitation server on a wondows 2003 enterprise server (32 bit), to give you a background of the setup, I have a PDC with Win 2K3 x64, Test server 1 which acts as a Additional domain controller, and runs Exchange 2003, (configured with Outlook web access and successfully running). This Test server 1 also has OCS 2007 running and configured with Communicator Web Access. Test Server 2, is also configured as an additional domain controller, and configured as an Edge Server.
The Problem:
With Test server 1 configured as the Communicator Web access server, I am able to Use either Web access or Office communicator. If I Use TCP, then i can use communicator and web access gives me an error. If i use TLS, then Web Access works fine but Communicator Gives me an error stating ‘There was a problem Verifying the Certificate from the Server’. I Used an Internal Root CA (configured in Test Server 1) and the Subject Name was given as ocs.testdomain.com.
I’m a little confused. Any help would be appreciated.
Thanks.
Naveen
Снова в эфире ответы на вопросы из моей почты, да-да. На этот раз вопрос от партнера, развертывающего у себя Office Communications Server 2007 R2. При подключении к серверу клиентов через Internet выдается ошибка: “There was a problem verifying the certificate from the server. Please contact your system administrator”.
При подключении из внутренней сети все нормально, никаких проблем.
Эта ошибка может появляться, если цифровой сертификат на сервере OCS 2007 невозможно проверить через один из публично доступных, или корневых центров сертификации, таких, как, например, Verisign.
Решений у этой проблемы может быть несколько.
Вариант 1. Если вы используете сертификат, выпущенный не доверенным центром, например, внутренним сервером PKI, то можно вручную импортировать его в нужное хранилище:
1. Запустите сеанс MMC и добавьте оснастку Certificates для локального компьютера
2. Перейдите к ветке Доверенные корневые центры сертификации (Trusted Root Certification Authorities), затем Сертификаты (Certificates)
3. Клик правой кнопкой мыши на Certificates -> All Tasks –> Import
4. Следуйте инструкциям на экране для импорта сертификата в это хранилище.
Эту же задачу — добавление сертификата в список доверенных на каждом клиентском ПК можно автоматизировать с помощью групповых политик Active Directory либо с помощью SCCM в зависимости от инфраструктуры.
Вариант 2. Использовать сертификат, выпущенный доверенным центром, то есть приобрести такой сертификат хоть у того же VeriSign. Он же пригодится при использовании коннектора Public IM Connectivity для интеграции с публичными сервисами мгновенных сообщений, таким как Yahoo!Messenger, Live Messenger или даже ICQ — там нельзя использовать самовыпущенные сертификаты.
Вариант 3. Отказаться от сертификатов и использовать протокол TCP вместо TLS в ущерб безопасности. [UPDATE] Этот вариант, как правильно подсказал Александр Донин ниже в комментариях, не возможен из-за того, что Edge-сервер не даст использовать не TLS-соединения для подключения к серверу. Вы скажете (я тоже об этом сначала подумала), что, мол, а внутри сети как же? Так ведь внутри сети и проблемы с проверкой самоподписанного/самовыпущенного сертификата нет, если доступен CA, который может удостоверить подлинность сертификата. Весь сыр-бор как раз из-за того, что в описанном случае сертификат извне невозможно проверить без дополнительных телодвижений. [/UPDATE]
На мой взгляд, самый правильный вариант – второй. Помимо прочего, публично заверенный сертификат пригодится еще и при настройке федеративных отношений с доменами бизнес-партнеров, например. Первый же вариант, в принципе, подойдет небольшим компаниям с небольшим количеством мобильных пользователей и без строгих требований к обеспечению безопасности коммуникаций.