How to Install an SSL certificate on Skype for Business

This guide shows you how to install an SSL certificate on Skype for Business Server (formerly Microsoft Lync). You can assign the certificate with the graphical Deployment Wizard or with PowerShell.

Microsoft often recommends a UCC certificate here, because a Skype for Business deployment usually has to secure several subject alternative names (for example the SIP domain, the web services FQDN, and the simple URLs) on the same certificate.

A note on Skype for Business Server versions

Before you begin, confirm which version you run, because the support status changed recently:

• Skype for Business Server 2015 and 2019 reached end of support on October 14, 2025. Microsoft’s first paid Extended Security Update (ESU) window ran through April 14, 2026, and a second six-month ESU period covers May to October 2026 for organizations that buy it separately. After that, no further ESU extensions are planned, so plan your migration accordingly.
• Skype for Business Server Subscription Edition (SE), released in July 2025, is the current on-premises version and follows the Microsoft modern lifecycle.
• Many organizations have moved to Microsoft Teams, which uses Microsoft-managed certificates and does not need the steps below.

The certificate request, import, and assignment process described here is the same on Skype for Business Server 2015, 2019, and Subscription Edition. If you are still on 2015 or 2019, plan a migration, but you can keep certificates valid in the meantime with these steps.

Generate the CSR on Skype for Business

If you have already requested your certificate and received it from your Certificate Authority, skip the CSR section and go straight to the installation steps.

Certificate issuance starts with a CSR (Certificate Signing Request), the encoded request you submit to a Certificate Authority. You have two options:

• Use our CSR Generator to create the CSR and private key automatically.
• Follow our step-by-step tutorial on how to generate a CSR on Skype for Business, which uses the Deployment Wizard to build the request from your published topology.

Generating the CSR through the Deployment Wizard is the more reliable route, because it reads the subject alternative names directly from your Skype for Business topology, so the certificate covers every name the deployment needs. Submit the CSR to your Certificate Authority during the order. After the CA validates it and issues the certificate, continue with the installation below.

Install the SSL certificate on Skype for Business

After your CA sends the files, download the archive and extract it on the server. Skype for Business expects the certificate in PKCS#12 (.pfx or .p12) or PKCS#7 (.p7b) format, and the .pfx must include the private key. If your CA delivered separate PEM files (.crt plus .ca-bundle), convert them to a single .pfx first with OpenSSL or a conversion tool. Our guide on SSL certificate formats walks through the conversion.

You can complete the installation in two ways: the graphical Deployment Wizard or the Skype for Business Server Management Shell (PowerShell). The Deployment Wizard is the method Microsoft documents first and is the easier choice for most administrators. Both are covered below.

Option A: Assign the certificate with the Deployment Wizard

Run these steps on each Front End Server, signed in as a member of the local Administrators group and the RTCUniversalServerAdmins group:

1. Open Start and launch the Skype for Business Server Deployment Wizard.
2. Click Install or Update Skype for Business Server System.
3. Next to Step 3: Request, Install, or Assign Certificates, click Run (it reads Run Again if certificates already exist on this computer).
4. In the Certificate Wizard, select the certificate you imported (for example the Default certificate), then click Assign and follow the prompts. To bring in a certificate from an archive instead, choose Import Certificate first and point it at your .pfx file.
5. Click Next through the assignment summary, then Finish, and close the wizard.

The same Step 3 also has a Request action, so you can generate the CSR, import the issued certificate, and assign it without leaving the wizard.

Option B: Assign the certificate with PowerShell

Open the Skype for Business Server Management Shell as an administrator. First, import the certificate. Pass the full path to your .pfx file, and keep the private key exportable so the certificate can replicate to your other Front End Servers:

Import-CsCertificate -Path "C:\your_certificate.pfx" -PrivateKeyExportable $True

If the .pfx is password protected, add the -Password parameter, for example -Password "YourPfxPassword".

Locate your certificate thumbprint

You assign a certificate by its thumbprint. The certificate you just imported is in the local computer’s personal store but is not yet assigned to Skype for Business, so read its thumbprint from the Windows certificate store (replace yourdomain.tld with your common name):

Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*yourdomain.tld*"} | Format-List Subject, Thumbprint, NotAfter

Copy the Thumbprint value from the output. You will need it in the next step. Note that Get-CsCertificate lists only certificates already assigned to Skype for Business roles, so use it to verify the assignment after the next step, not to find the thumbprint now.

Assign the certificate to a service role

Decide which service the certificate should secure and pass it to the -Type parameter. Common roles are Default, WebServicesInternal, and WebServicesExternal. For the full list of certificate types, see Microsoft’s documentation on the Set-CsCertificate cmdlet.

Assign the certificate by its thumbprint (the value below is only an example, use your own):

Set-CsCertificate -Type WebServicesExternal -Thumbprint "B142918E463981A76503828BB1278391B716280987B"

You can also assign several roles at once without copying the thumbprint by hand. Capture the imported certificate in a variable, then pass its thumbprint to Set-CsCertificate:

$cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*yourdomain.tld*"}
Set-CsCertificate -Type Default,WebServicesInternal,WebServicesExternal -Thumbprint $cert.Thumbprint

That assigns the certificate to the Default, internal web services, and external web services roles in one command. For background on each cmdlet, see Microsoft’s reference for Get-CsCertificate and Set-CsCertificate. After you assign the certificate, restart the affected services (or the Front End service) so Skype for Business begins using it.

Once the certificate is in place, scan it for chain and configuration errors with our SSL Checker.

Frequently Asked Questions