How to Generate a CSR on Skype for Business Server

This guide shows you how to generate a CSR (Certificate Signing Request) on Skype for Business Server. You can build the request two ways: with the graphical Certificate Wizard inside the Skype for Business Server Deployment Wizard, or with the Request-CsCertificate cmdlet in the Skype for Business Server Management Shell. Both read the names for the certificate out of your published topology, which is why they are more reliable here than a generic CSR tool.

These steps apply to Skype for Business Server (on-premises): 2015, 2019 and Subscription Edition. They do not apply to Skype for Business Online, which retired on July 31, 2021, or to consumer Skype, which retired on May 5, 2025. If your organization has already moved to Microsoft Teams, Microsoft manages the certificates for the service and there is no CSR to generate.

Check your Skype for Business Server version first

Open the Skype for Business Server Management Shell and list the build of every installed component:

Get-CsServerPatchVersion

The related Get-CsServerVersion cmdlet reports licensing and the base build of the local server only, without the cumulative update, so use Get-CsServerPatchVersion when you need to know exactly which update level you are on.

Support status as of July 2026:

• Skype for Business Server 2015 and 2019 both reached the end of extended support on October 14, 2025.
• The paid Extended Security Update program ran from October 2025 to the end of April 2026 (Period 1). A second window, Period 2, runs from May 2026 to the end of October 2026. Period 2 has to be purchased separately: buying Period 1 does not roll over into it, and you do not need to have bought Period 1 to buy Period 2.
• Microsoft restated on July 21, 2026 that there will be no further extension. Once October 2026 ends there are no more updates for 2015 or 2019, even for organizations holding Period 2 ESU.
• Skype for Business Server Subscription Edition started on July 1, 2025, follows the Microsoft Modern Lifecycle Policy and is the current on-premises release. It is installed as an in-place upgrade of Skype for Business Server 2019.

The CSR procedure is identical on all three. Support status does not change how certificates behave: an expired certificate breaks client sign-in, meeting joins and server-to-server TLS whatever release you run, so keep renewing while you plan the move.

Before you generate the CSR

• Publish your topology first. Both routes read the subject name and the subject alternative names out of the topology document that Topology Builder published to the Central Management store. The wizard shows them on a read-only summary page. If a name there is wrong, cancel the wizard, correct it in Topology Builder, republish, and start the request again.
• Create the DNS records first. Every name that ends up on the certificate needs to resolve for the clients that will use it.
• Check your permissions. To run the Certificate Wizard you have to be a member of RTCUniversalServerAdmins. Microsoft says an offline request to a public CA needs no group membership beyond that one, but processing the CA’s response and assigning the certificate later needs the local Administrators group as well. Requesting online from an internal Windows CA needs local Administrators plus an authenticated domain account in the domain that holds the CA.
• Decide which certificate you are requesting. A Front End or Standard Edition server has a Default certificate plus internal and external web services certificates. An Edge Server has a separate external certificate and internal certificate. They are not interchangeable.

Which Skype for Business certificates can a public CA sign?

Not all of them, and this is the point that catches most people out. Since November 2015 the CA/Browser Forum Baseline Requirements have prohibited publicly trusted CAs from issuing certificates for internal server names and reserved IP addresses. Anything ending in .local, any single-label host name and any FQDN in a domain you do not publicly own cannot go on a public certificate.

• From a public CA: the external Edge certificate and the reverse proxy certificate. Microsoft’s guidance is that the external Edge interfaces need a certificate from a public CA at a minimum, because external clients and federated partners have to trust it.
• Usually from your internal CA: the Default certificate, the internal web services certificate, the Director certificate and the internal Edge certificate. These carry pool and server FQDNs that are often internal names. If your internal FQDNs happen to sit in a domain you own publicly, you can buy a public certificate for them instead. Microsoft explicitly allows the internal Edge certificate to come from either a public CA or your internal CA.

Because the external certificate carries several names at once, this is normally a multi-domain (UCC/SAN) certificate. Microsoft documents wildcard entries as supported for the simple URL names and for the autodiscover names, but the documented Edge certificate lists each SIP access name explicitly, so list a separate sip.yourdomain.tld entry for every SIP domain rather than relying on a wildcard.

Plan the subject name and the SAN entries

Skype for Business certificates are SAN-heavy, and browsers and clients match the hostname against the SAN field, not the Common Name. Getting this list right before you order is the difference between one certificate and a reissue. The table uses Microsoft’s own example domains: contoso.com as the primary SIP domain, fabrikam.com as a second SIP domain and contoso.net as the internal domain.

Certificate	Subject name (CN)	Subject alternative names	Example
Default (Standard Edition or Front End pool)	Pool FQDN	Pool FQDN and server FQDN. Add sip.sipdomain for each SIP domain if this pool is the auto-logon server and strict DNS matching is enforced in group policy.	SN=eepool.contoso.com; SAN=eepool.contoso.com; SAN=ee01.contoso.com
Web internal	Pool FQDN (server FQDN on Standard Edition)	Internal web FQDN, server FQDN, pool FQDN, the Meet simple URL for every SIP domain, the Dial-in simple URL and the Admin simple URL	SN=eepool.contoso.com; SAN=eepool.contoso.com; SAN=ee01.contoso.com; SAN=meet.contoso.com; SAN=meet.fabrikam.com; SAN=dialin.contoso.com; SAN=admin.contoso.com
Web external	Pool FQDN (server FQDN on Standard Edition)	External web FQDN, the Meet simple URL for every SIP domain, and the Dial-in simple URL	SN=eepool.contoso.com; SAN=webcon01.contoso.com; SAN=meet.contoso.com; SAN=meet.fabrikam.com; SAN=dialin.contoso.com
Mobility (added to the Front End and Director certificates)	As above	The internal autodiscover name and the external autodiscover name, one pair per SIP domain	SAN=lyncdiscoverinternal.contoso.com; SAN=lyncdiscover.contoso.com
External Edge	The sip name of your primary SIP domain	One sip entry per SIP domain plus the web conferencing Edge FQDN	SN=sip.contoso.com; SAN=sip.contoso.com; SAN=webcon.contoso.com; SAN=sip.fabrikam.com
Internal Edge	Edge internal FQDN	None. The internal Edge certificate uses a subject name only.	SN=sfbedge.contoso.net
Reverse proxy	External web services FQDN	The external autodiscover name plus your external web services FQDNs	SAN=lyncdiscover.contoso.com; SAN=skypewebextpool01.contoso.com; SAN=dirwebexternal.contoso.com

Four details worth checking before you submit:

• Simple URLs. You need one Meet simple URL per SIP domain, one Dial-in simple URL for the whole organization, and the Admin simple URL is optional. Every Meet URL you use has to be on the certificate.
• sipinternal and sipexternal. If you created sipinternal.contoso.com or sipexternal.contoso.com records in DNS, Microsoft requires them in the SAN list as well.
• The A/V name is not a SAN. av.contoso.com is a DNS record for the A/V Edge service, which does not use a certificate to encrypt media, so it does not belong on the request. The external Edge certificate is assigned to Access Edge, Web Conferencing Edge and the separate A/V Authentication service.
• Edge pools share one certificate. Every Edge Server in a pool has to carry the exact same certificate and the same private key for the media relay authentication service, so this is the one request where you do need an exportable private key.

Generate the CSR with the Deployment Wizard

If you already generated your CSR with another tool, skip this and follow our guide on how to install an SSL certificate on Skype for Business Server instead.

Run these steps on the server the certificate is for: the Front End Server for a Default or web services certificate, the Edge Server for an Edge certificate.

1. Open Start and launch the Skype for Business Server Deployment Wizard.
2. Click Install or Update Skype for Business Server System.
3. Next to Step 3: Request, Install or Assign Certificates, click Run. It reads Run Again if certificates already exist on this computer.
4. In the Certificate Wizard, select the certificate you need (for example Default certificate, or External Edge certificate on an Edge Server) and click Request.
5. Choose Prepare the request now, but send it later (offline certificate request). That is the option for a public CA. The alternative, Send the request immediately to an online certification authority, enrolls against a CA inside your own PKI, normally an internal Windows CA, and is not a route to a public CA.
6. Type the path and file name for the request in the File Name box, or click Browse to pick a location. Note where you save it. The default is the Documents folder of the account running the wizard.
7. On the Name and Security Settings page, type a Friendly Name that is unique in the computer’s certificate store, then pick the Bit length. The list offers 1024, 2048 and 4096: choose 2048, since no public CA will sign a 1024-bit key. Leave Mark the certificate’s private key as exportable clear unless you are requesting the certificate for an Edge Server pool, which is the case Microsoft names as the one that requires it.
8. On the Organization Information page fill in Organization and Organizational Unit. The OU is free text on the certificate and does not have to match an Active Directory organizational unit.
9. On the Geographical Information page select the Country, then type State/Province and City/Locality. Spell both out in full, so Arizona rather than AZ.
10. Review the Subject Name / Subject Alternative Names page. These entries come from your published topology and cannot be edited here. If one is wrong, click Cancel, fix it in Topology Builder, republish the topology, and start the request again.
11. On the SIP Domain setting on Subject Alternate Names (SANs) page, tick your primary SIP domain and any other SIP domain this certificate has to cover. If you tick none and your configuration changes later, you will have to request a new certificate.
12. On the Configure Additional Subject Alternate Names page, add any name the topology did not supply: type the FQDN and click Add. Remove and Clear All only affect entries you added on this page, not names that came from the topology.
13. Check the request summary and click Next to generate the CSR. On the Certificate Request File page, click View to open the request in Notepad so you can copy it, then click Finish.

Generate the CSR with PowerShell

Open the Skype for Business Server Management Shell as an administrator and run Request-CsCertificate. It builds the same request the wizard does: the cmdlet analyzes your topology before it writes the file, and fills in the subject name and the subject alternative names for you.

A complete offline request for a Front End Server looks like this. It is one line, so copy the whole thing:

Request-CsCertificate -New -Type Default,WebServicesInternal,WebServicesExternal -ComputerFqdn "ee01.contoso.com" -FriendlyName "SfB Front End 2026" -KeySize 2048 -Organization "Contoso Ltd" -OU "IT" -Country US -State "Arizona" -City "Phoenix" -DomainName "meet.contoso.com,dialin.contoso.com,admin.contoso.com,lyncdiscover.contoso.com" -Output "C:\certs\contoso_sfb.csr"

What each part does:

• -New starts a new request and is required for this form of the command.
• -Type is mandatory. It names the service roles the certificate covers, and those roles decide which FQDNs the cmdlet puts in the SAN field.
• -Output writes an offline request to the path you give. This is what makes the command produce a CSR you can send to a public CA. Leave it out and add -CA instead, and the cmdlet contacts an internal Windows CA directly.
• -ComputerFqdn is the FQDN of the computer the certificate is for. Microsoft’s guidance is to always use the computer name, even when you are requesting a pool certificate, because the cmdlet adds the pool name to the subject on its own.
• -DomainName takes a comma-separated list of extra FQDNs to add to the SAN field, on top of the ones the topology supplies.
• -Organization, -OU, -Country, -State and -City populate the subject. Country takes the two-letter code (US, GB, DE); spell out the state and city in full.
• -KeySize accepts 1024, 2048 and 4096. Use 2048 or larger.
• -FriendlyName labels the certificate in the Windows store, and has to be unique in that store.
• -PrivateKeyExportable $True marks the key exportable. Set it only when you genuinely need to copy the certificate to another machine, such as the Edge pool case below.
• -AllSipDomain adds every SIP domain to the SAN field. Without it only the primary SIP domain goes in automatically.
• -Template names a certificate template on an internal CA. It has no meaning for a public CA request.

Certificate types you can pass to -Type

Microsoft documents these values, and notes the list is not exhaustive: AccessEdgeExternal, AudioVideoAuthentication, DataEdgeExternal, Default, External, Internal, iPhoneAPNService, iPadAPNService, MPNService, PICWebService, ProvisionService, WebServicesExternal, WebServicesInternal and WsFedTokenTransfer. Separate several types with commas.

Two of those are dead ends on an on-premises server: Microsoft lists PICWebService and ProvisionService as Skype for Business Online types, and that service retired in 2021. In practice you will use one of three combinations:

• Front End or Director: -Type Default,WebServicesInternal,WebServicesExternal
• Edge internal interface: -Type Internal
• Edge external interfaces: -Type AccessEdgeExternal,DataEdgeExternal,AudioVideoAuthentication

The external Edge request is the one that needs an exportable key, because every Edge Server in the pool has to share the same certificate and key:

Request-CsCertificate -New -Type AccessEdgeExternal,DataEdgeExternal,AudioVideoAuthentication -ComputerFqdn "sfbedge01.contoso.net" -FriendlyName "SfB Edge External 2026" -KeySize 2048 -PrivateKeyExportable $True -Organization "Contoso Ltd" -OU "IT" -Country US -State "Arizona" -City "Phoenix" -DomainName "sip.contoso.com,webcon.contoso.com,sip.fabrikam.com" -Output "C:\certs\contoso_edge.csr"

Keep RSA as the key algorithm

The cmdlet also has a -KeyAlg parameter that accepts RSA, ECDH_P256, ECDH_P384 and ECDH_P521. Microsoft’s own system requirements state that Skype for Business Server does not support CNG certificates, and public CAs expect RSA in this workflow, so leave -KeyAlg alone and let the request use RSA. The same document also rules out the RSASSA-PSS signature algorithm, which it says can cause sign-in and call forwarding failures.

Managing requests you have already made

The same cmdlet tracks its own pending requests. List them, retrieve one that has been issued, or delete one by its request ID:

Request-CsCertificate -List
Request-CsCertificate -Retrieve
Request-CsCertificate -Clear -RequestId 224

Clearing a request is also the documented fix when retrieval fails because a revoked request is in the way: Request-CsCertificate handles only Issued, Denied and Pending states.

Submit the CSR to your Certificate Authority

Open the file you saved in a plain text editor. The wizard’s View button opens it in Notepad for you. Copy everything, including the header and footer lines. Windows normally writes them like this:

-----BEGIN NEW CERTIFICATE REQUEST-----
MIICtjCCAZ4CAQAwcTELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0FyaXpvbmExEDAO
... many more lines of base64 ...
jCD4RG92Kab0LzO1Hl07fPvTf8j4kDkWhlE=
-----END NEW CERTIFICATE REQUEST-----

Some tools write BEGIN CERTIFICATE REQUEST without the word NEW. Both are the same PKCS #10 request and Certificate Authorities accept either. Note that those markers are five plain hyphens on each side. If a word processor or a rich-text field converts them into typographic dashes, or drops a line break, the CA will reject the request as malformed, so paste into a plain text field.

Before you pay for validation, run the block through our CSR Decoder and confirm that every name from your planning table really appears in the SAN list. A missing Meet URL or a forgotten second SIP domain means a reissue.

Two things to avoid while you wait for the certificate:

• Do not clear the pending request or rebuild the server. The private key stays in that server’s certificate store and never leaves it. The issued certificate is useless without the matching key.
• Do not request a second CSR for the same certificate and submit both. Each request creates its own key pair, and the certificate the CA returns will only pair with one of them.

Plan the renewal date now. Since March 15, 2026 publicly trusted TLS certificates are capped at 200 days, dropping to 100 days on March 15, 2027 and 47 days on March 15, 2029. A manual wizard-driven renewal on Skype for Business now comes round at least twice a year, so put it in the calendar with the topology notes attached.

If you would rather not generate the request on the server at all, our CSR Generator builds a CSR and a private key in your browser. On Skype for Business that is the weaker option, because the request will not pick up the names from your topology and you would then have to convert the issued certificate into a .pfx file and import the key by hand.

After the CA issues your certificate

The CA returns the certificate once validation completes. Import it on the same server, then assign it to the service roles you requested it for, either back in Step 3 of the Deployment Wizard or with the Import-CsCertificate and Set-CsCertificate cmdlets. Our companion guide on how to install an SSL certificate on Skype for Business Server walks through both.

Because you generated the request on this server, the private key is already in its certificate store, so what the CA returns is the certificate on its own. Import it as delivered: a .cer or .crt file, or the .p7b bundle many CAs ship for Windows. There is nothing to convert. You only need a PKCS#12 file (.pfx or .p12) when the certificate and its private key have to travel together, which is the case when you built the CSR on a different machine. Combine them with OpenSSL first, then import the .pfx with its password:

openssl pkcs12 -export -out cert.pfx -inkey private.key -in cert.crt -certfile chain.crt

Once the certificate is assigned and the services have restarted, scan the external name with our SSL Checker to confirm the chain and the SAN list are what you expect.

Frequently Asked Questions