Sunday, July 10, 2011

Lync Phone Edition and third party Root CA Authority


As a Network Administrator, I often check variety of server and application logs to verify the health of the environment. Today I‘ve noticed that the Aastra 6725ip phone in my office (connecting to my home lab's Lync deployment via public internet) never updated the firmware to the latest – “4.0.7577.250”. Strange indeed… 

Now I remembered that the phone never downloaded the Address Book either. Why would that be? I have deployed reverse proxy with certificate from StartSSL, which is included in the Root CA Authority of Windows OS. The functionality was verified and external users could successfully connect to a meeting organized by lynclog.com user.

Quick reference to the TechNet article revealed the sad truth – while StartSSL is present on Root CA store of Windows, it is not in Lync Phone Edition.


Now what?!? Looks like the certificate I use on TMG provides only half of the functionality… or does it? If you think of it, my internal Domain Root CA is not presented in the Phone Edition store either, and yet a phone connected to the LAN works. This is, because according the article, “First, the device searches for Active Directory Domain Services (AD DS) objects of the category certificationAuthority. If the search returns any objects, the device uses the attribute caCertificate. That attribute is assumed to hold the certificate, and the device installs the certificate.

The root CA certificate must be published in the caCertificate for Lync Phone Edition.”

So, what if I use “certutil -f -dspublish RootCA” and publish the StartSSL Root CA in my pKIEnrollmentService store? The assumption is that AFTER I connect a device for first time on a LAN network and sign in, all certificates in the Domain Certificate Authority will be downloaded to the device (including StartSSL Root CA) and later, when I take the device on Public Internet, as long as it is not reset to “factory defaults”, where the Certificate Store will be restored to original state, the phone will trust my Reverse Proxy and it should download updates, address book etc. Needless to say, my lab Exchange server also uses StartSSL for OWA service and so, this integration should function as well.

One way to find out - I have already downloaded StartSSL Root CA to my domain controller...



 …and will use the above command to publish it.


As we can see, the certificate was added. I should expect to find it in the phone edition store after resetting it and sign in again.

After some digging through the SELog, I found the following line:


For now, I will “assume success” as well and take the device to my office tomorrow to examine the result. Also, a quick look at just joined to lynclog.com domain workstation shows that StartCon (StartSSL) Root CA is present in the local Trusted Root Certification Authorities i.e. downloaded automatically along with the Domain Root CA.


As usual, this example is for testing purposes only. A caution and careful consideration is necessary if/when the Administrator decides to push third party Root CA via Active Directory Certificate Services.

07/13/2011 Update:
As a Proof Of Concept – it worked as expected. The phone, looged over Internet, did promptly update the firmware and rebooted. HOWEVER, this method should not be used in production environment. To me it looks like Phone Edition Update is an image based and firmware upgrade replaces everything (including the local Certificate Store) thus rendering our exercise above inapplicable in production environment.

28 comments:

Chris Norman said...

Nice post Drago. I had a question about this just recently.

Drago said...

Chris,

I could not test today from the office – first day after vacation… you know how it is. In any case (success or failure), I will report once get some results.

Adrien said...

Unfortunately, Aastra phone did not benefit from your workaround.
They don't load the new CA, and thus they can't connect to Exchange at all.

Has Microsoft any idea on when they will include the same CA in the trusted roots for Lync, Exchange and Lync Phone?

Drago said...

If when you say “the same CA”, if you are referring to StartSSL, there is one simple answer: never. By default, Windows server 2008 and later has very limited Trusted Root CA upon installation. An extended list (where StartSSL is included) is offered via Windows Update Service.

Mobile devices are whole different story. I am not sure what are the limitations (if any), but you have noticed that only top lever Root CA are included. Lync Devices are pretty much the same…

A list of Public Authorities for Lync Phone Edition devices can be found here http://technet.microsoft.com/en-us/library/gg398270.aspx

Anonymous said...

I was wondering where the SELog is that you referred to?

William T.Mack said...

I am often to blogging and i really appreciate your content. The article has really peaks my interest. I am going to bookmark your site and keep checking for new information.
getkingrootapk.info

Sophie Grace said...

Very useful post. This is my first time i visit here. I found so many interesting stuff in your blog especially its discussion. Really its great article. Keep it up. Please search instagram story viewer to discover nice photos and videos on instagram.

Online Games said...

We’ve heard the question “is online betting safe?” thousands of times and it’s a legit concern. There are risks associated with any kind of real money gambling, and that risk is magnified when you’re betting online with sportsbooks and bookmakers that don’t have a physical presence. https://gervaisjervis9.wixsite.com/tooltech/post/tips-for-finding-the-best-cricket-betting-sites-in-india

Online Games said...

With advancement and innovations in technology making cricket gambling possible and accessible now, there is no reason not to wager your bet now.
http://users.atw.hu/handsupforum/profile.php?mode=viewprofile&u=1939

Email Marketing Guide said...

Hey i am for the primary time here. I came across this board and I to find It truly useful & it helped me out a lot. I’m hoping to provide something back and help others such as you aided me. Visit instagram story viewer

https://www.theartfulhomedomain.com/site/bestofbettingsites.com said...

I came across your blog while searching for submissions. Nice strategy for the future, I'll be bookmarking your entire rises right away...

https://www.linkspropeller.com/site/bestofbettingsites.com

Ashish said...

Cricket betting india not only provides with tips and tricks to bet online but also provide you with detailed strategy and guideline how to play and place the bets on various e-sports http://users.atw.hu/handsupforum/profile.php?mode=viewprofile&u=1939

Unknown said...

You can find reviews of online cricket betting sites, details about where to get the best cricket betting odds, 100 percent free cricket betting tips as well as articles on the topic of online cricket betting on cricket betting india.
https://www.sqlservercentral.com/forums/user/cricketbettingindia-org

Ashish Mehta said...

Cricket betting India aims at providing the latest information about online betting in India. You will get to know all about the cricket betting terminology and online cricket betting here at our platform.
https://speakerdeck.com/cricketbettingindia

Ashish Mehta said...

Buying sex toys online is more than just shopping for vibrators & getting a box of condoms; that's an adventure. You will get the support you have to find out which product is right when you're at an Adult Shop Online.
https://pleasuredenaustralia.blogspot.com/2020/08/4-greatest-sex-toys-for-couple-in-2020.html

besttrevel said...

This is a very helpful article. This is my first visit to this place. I found a lot of interesting information on your blog, particularly the discussion. It's a fantastic post. Continue to do so. http://myfishbook.fr/membres/bestnarantour/

Renu Yadav said...

I have read a few of the articles on your website now, and I really like your style. Thanks a million and please keep up the effective work. To know about online cricket betting, check out here: https://www.playping.com/engagedeals/status/63751

Ashish said...

cric10 app download offers a wide spectrum of ways for carrying out online betting. You should choose an online betting sites that offers your preferred method of transacting money.
http://sonicsquirrel.net/detail/user/MeghMallar123/

mobile-windscreen said...

Thank you for giving this useful information; I'd like to add it to my bucket list; keep blogging! I appreciate a lot of the material you've provided, especially the comments, and I'll be back. spoke.com/companies/mobile-windscreen-60b4a40730f3613ff20081c4

N.S Kehal said...

Being one of the best professional accounting firms in Vancouver, we committed to delivering financial and accounting services that will be tailored to your business. Our professional advice will support you in every way.
https://www.proformative.com/users/ns-kehal

Male Enhancement said...

Thank you for providing this great information; I'd like to add it to my bucket list; please continue blogging! I appreciate a lot of the information you've supplied, particularly the comments, and I'll return. https://bookme.name/enquirymart

Ashish Mehta said...

Commercial finance can cover a range of lending products for businesses. It can include short or long-term funding for the purposes of purchasing a business premises, including shops, guest houses, nursing homes, pubs, farms, office blocks or restaurants. It can be a complex area, with specialist lenders involved and criteria varying from provider to provider, so it is wise to seek advice from a whole-of-market mortgage broker such as AWS. We have established relationships with lenders specialising in commercial finance so can help identify the best funding for your business, at competitive rates.
https://webzworks.com/why-should-you-use-a-contractor-mortgage-broker/

N.S Kehal said...

Being on top will be overwhelming work for businesses and individuals. If you are unable in dealing with tax issues, then it will be difficult for you next time as of the complex tax system in Canada. The best consultation of an accountant in Surrey BC will help you in this case.
http://ttlink.com/kehalcpa

goodreads said...

Thank you for giving this useful information; I'd like to add it to my bucket list; keep blogging! I appreciate a lot of the material you've provided, especially the comments, and I'll be back. https://www.goodreads.com/user/show/138236166-pradorey-bodegas

Ashish Mehta said...

Want the same feeling as during couple sex, masturbators is required. Slip your feeling of sex to a great extent with the use of this toy. Having problems stimulating your genitals? No need to worry if you can grab such an awesome toy for arousing genitals. Choose right masturbator tool so that your masturbation or sex life can become great and loving.
https://www.sitelike.org/similar/pleasureden.com.au/

deviantart said...

The information you've provided is quite useful, and I appreciate you sharing it with me. I thoroughly enjoyed reading your blog. It was well-written and easy to understand. https://www.deviantart.com/turkeytour/about#about

Ashish Mehta said...

Having years of experience in providing mortgage advice to clients, SWG Mortgages advisors perform all these steps with full accuracy and commitment and provide the information you need in a clear and accurate manner. Their goal is to provide excellent services to the mortgage applicants.
http://www.social-bookmarkingsites.com/story/remortgage-options-remortgage-broker-2

UK Immigration said...

If you are seeking for the best immigration lawyers in Pakistan for a UK visa, please contact our top immigration lawyers in Pakistan