How to change Certificate on Skype for Business Server

Learn how to manually import and assign a replacement certificate to Skype for Business Server or Lync certificate usages and verify services.

Skype for Business Server and Lync assign certificates to usages such as Default, WebServicesInternal, and WebServicesExternal. Replacing a certificate requires the product Management Shell; importing a PFX into Windows alone does not update those assignments.

Before you begin

Inventory the topology and current assignments with Get-CsCertificate. Obtain a PFX whose SANs and EKUs meet the role and usage requirements. Plan a rolling change across Front End, Director, and Edge roles rather than assuming one shared store.

Step-by-step certificate replacement

In the Skype for Business Server Management Shell, import the PFX:

$password = Read-Host "PFX password" -AsSecureString
Import-CsCertificate -Path C:\secure\sfb.pfx -Password $password `
  -PrivateKeyExportable $false
Get-CsCertificate | Format-List Use,Issuer,Subject,Thumbprint,NotAfter

Assign the new thumbprint to each intended usage, one role at a time:
```
Set-CsCertificate -Type Default -Thumbprint <thumbprint>
Set-CsCertificate -Type WebServicesInternal -Thumbprint <thumbprint>
```
Do not copy this list blindly; assign only the usages shown in the topology and covered by the certificate.
Follow the cmdlet output and version-specific product guidance for service activation. Drain pooled Front Ends and update nodes sequentially.

Verify the new certificate

Run Get-CsCertificate, Skype for Business validation cmdlets for the affected role, and network TLS tests for internal/external web services and SIP endpoints. Verify every pool member through and around the load balancer.

Rollback

Run Set-CsCertificate with the old thumbprint for each changed usage and perform the same activation step. Do not remove the old certificate until all usages are checked.

Common problems

Wrong certificate usage or SAN set.
PFX imported but not made known through Import-CsCertificate.
One Front End in a pool retains the old assignment.
Edge and internal roles are assumed to have identical requirements.

Automating certificate replacement with aethercert

The aethercert Skype for Business / Lync target invokes Import-CsCertificate and Set-CsCertificate for the explicitly selected usages on the local server.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.