Replace the Skype for Business Server Certificate

Skype for Business Server and Lync Server assign certificates to types (usages) such as Default, WebServicesInternal and WebServicesExternal on each server, and AccessEdgeExternal, DataEdgeExternal and AudioVideoAuthentication on Edge servers. Importing a PFX into Windows alone does not change these assignments - that is done in the Skype for Business Server Management Shell.

Before you beginCopy Anchor Link

• List the current assignments on each server:

  Copy Text

  Get-CsCertificate | Format-List Use,Issuer,Subject,Thumbprint,NotAfter

• Get a PFX whose subject and SANs cover every name the replaced types need (pool FQDN, web services names, simple URLs, Edge names). Front End, Director and Edge servers have different requirements - do not assume one certificate fits all.

• Note the old thumbprints from the Get-CsCertificate output - you need them for a rollback.

• Plan a rolling change, one server at a time. On a pooled Front End, stop the services gracefully first, so users move to the other pool members:

  Copy Text

  Stop-CsWindowsService -Graceful

Step-by-step certificate replacementCopy Anchor Link

1. In the Skype for Business Server Management Shell, import the PFX:

   Copy Text

   $password = Read-Host "PFX password" -AsSecureString
   Import-CsCertificate -Path C:\secure\sfb.pfx -Password $password `
     -PrivateKeyExportable $false
   Get-CsCertificate | Format-List Use,Issuer,Subject,Thumbprint,NotAfter

2. Assign the new thumbprint to the types this server uses - only those that Get-CsCertificate listed under Before you begin and that the certificate covers. Several types can be assigned in one command:

   Copy Text

   Set-CsCertificate -Type Default,WebServicesInternal,WebServicesExternal `
     -Thumbprint <thumbprint> -Report C:\Logs\cert-assign.html

   -Report writes an HTML log of what the cmdlet did.

3. To switch at a planned time instead of immediately (Lync Server 2013 and later), add -Roll together with -EffectiveDate; -Roll fails without a date:

   Copy Text

   Set-CsCertificate -Type Default -Thumbprint <thumbprint> -Roll `
     -EffectiveDate "2026-10-15 06:00"

4. Start the services again (Start-CsWindowsService) if you stopped them, and check with Get-CsCertificate that the assignment shows the new thumbprint.

5. Repeat on every server of the pool and on the Directors.

Edge serversCopy Anchor Link

Edge servers are usually not domain members and are changed on the Edge server itself, in the Skype for Business Server Management Shell there. They typically have two certificates:

Import and assign them with the same Import-CsCertificate and Set-CsCertificate commands, one Edge server of the pool at a time.

Verify the new certificateCopy Anchor Link

Run Get-CsCertificate on each server and compare Use, Thumbprint and NotAfter. Then test over the network, on every pool member directly and through the load balancer - the web services on 443 and SIP over TLS on 5061:

openssl s_client -connect pool01.example.com:443 -servername pool01.example.com -showcerts </dev/null
openssl s_client -connect fe01.example.com:5061 -showcerts </dev/null

The subject, issuer and expiry in the output must be the new certificate's.

Finally sign in with a client, both internally and externally.

RollbackCopy Anchor Link

Run Set-CsCertificate with the old thumbprint for each type you changed - also to override a switch scheduled with -Roll that has not happened yet. Keep the old certificate on the server until every type is verified; rolling back only helps while it is still valid.

Common problemsCopy Anchor Link

• A type was assigned that the certificate's names do not cover, or a needed type was missed.
• The PFX was imported into Windows, but not through Import-CsCertificate.
• One Front End in the pool still has the old assignment.
• Edge and internal servers were assumed to need the same certificate.
• -Roll was used without -EffectiveDate.

Automating certificate replacement with aethercertCopy Anchor Link

The aethercert Skype for Business / Lync target invokes Import-CsCertificate and Set-CsCertificate for the explicitly selected usages on the local server.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.

SourcesCopy Anchor Link

• Microsoft Learn: Import-CsCertificate
• Microsoft Learn: Set-CsCertificate
• Microsoft Learn: Get-CsCertificate