How to Generate the CSR on Skype for Business

Note: This guide applies to Skype for Business Server (on-premises), not Skype (consumer) or Skype for Business Online. Skype for Business Online retired on July 31, 2021, and Skype (consumer) retired in May 2025. For new deployments, Microsoft recommends Teams. The CSR steps below remain valid for Skype for Business Server 2019 and Skype for Business Server Subscription Edition.

In this tutorial, we will show you how to generate a CSR on Skype for Business.

Before generating the CSR, it’s necessary to indicate the service or services you wish to encrypt. You have to do this with the Type argument from the CSR generation command.

Generally, you can use the Default type.

The Default, AccessEdgeExternal, and DataEdgeExternal types are for Edge servers, while the WebServicesExternal and WebServicesInternal types are for web streams.

Here is a list of the most common arguments:

• AccessEdgeExternal
• AudioVideoAuthentication
• DataEdgeExternal
• Default
• External
• Internal
• iPhoneAPNService
• iPadAPNService
• MPNService
• PICWebService (retired; was Online only)
• ProvisionService (retired; was Online only)
• WebServicesExternal
• WebServicesInternal
• WsFedTokenTransfer

To generate the CSR you can use the Request-CSCertificate command. Run it in the powershell:

Request-CsCertificate -New -Type YOUR_TYPES -Organization "Your Organization" -Country US -State "Arizona"  -City "Phoenix" -FriendlyName "Skype SSL" -KeySize 2048 -DomainName "yourdomain.tld" -PrivateKeyExportable $True -Output C:\yourdomain.tld.csr

You’ll need to replace YOUR_TYPES with the specific Skype for Business service roles you want the certificate to cover. These roles control which FQDNs get included in the SAN (Subject Alternative Name) field of the CSR — which is crucial, because modern clients only validate names from SAN, not CN.

For example:

• If you’re requesting a cert for a Front End or Director server, use:
  -Type Default,WebServicesInternal,WebServicesExternal
• For an Edge internal cert:
  -Type Internal
• For an Edge external cert:
  -Type AccessEdgeExternal,DataEdgeExternal,AudioVideoAuthentication

Tip: You can mix types as needed, just separate them by commas.

You’ll also replace the sample org details (like Your Organization, US, etc.) with your own validated information.

The -PrivateKeyExportable $True flag ensures you’ll be able to export the certificate later (e.g., for use on other servers or appliances).

Alternative Method: Generate CSR via GUI (Deployment Wizard)

If you prefer using the graphical interface instead of PowerShell, Skype for Business Server includes a Deployment Wizard that guides you through certificate requests.

Step-by-Step (GUI Method):

1. Launch the Skype for Business Deployment Wizard. You can find it on your Front End server by navigating to: Start > Skype for Business Server Deployment Wizard
2. Select the option: “Install or Update Skype for Business Server System”
3. Click on Step 3: “Request, Install, or Assign Certificates”
4. Choose the correct server role: (e.g., Front End, Edge, Director). Then click “Request” under the appropriate certificate category.
5. Fill in the CSR request details
   • Friendly Name: A label for your reference (e.g., Skype Front End 2025)
   • Bit Length: Use 2048 or higher (RSA).
   • Mark private key exportable: Check this if you plan to export or move the certificate.
   • Organization details: Enter legal company name, locality, state, country code.
   • Common Name (CN): Your primary FQDN (e.g., sip.yourdomain.com)
   • Subject Alternative Names (SAN): The wizard automatically pulls SANs from your topology based on the selected server role. If you want to add extra SANs manually (like external web access FQDNs), click “Advanced” > “Add”
6. Save the CSR: Choose to export the CSR to a file — e.g., C:\cert_request.csr

Submit the CSR to your Certificate Authority. Paste the contents of the .csr file (including the —–BEGIN CERTIFICATE REQUEST—– and —–END CERTIFICATE REQUEST—– lines) into your CA’s order form.