Skype For Business Mac Date Time Certificate Error

by

Renewing Certificates in Skype for Business Server 2015

1/25/2016

Coming back to the office after a the year-end holidays like most people, I found that the Skype4B clients, IP Phones and Video Endpoints were no longer able to register with the Skype4B front-end pool. Yes time does pass very quickly and certificates that were created and assigned during installation do expire. The default expiry date for default FE server certificates is 2 years. This article explores the renewal of these FE certificates to get the system back to normal.
First and foremost, the client error message displayed during sign-in was rather misleading as this error was not due to DNS records at all. I suspect this could be due to the fact that this was a Hybrid setup with some users hosted on-premise and others hosted online on Office365. A quick check on the lyncdiscover.domain.com and lyncdiscoverinternal.domain.com DNS records as well as the fallback SRV records _siptinernaltls._tcp.domain.dom were correctly pointed to the on-premise FE Pool. Users who are homed online simply get redirected to the Office365 pool after they first hit the on-premise servers. Since the error cannot be due to DNS, then we need to look into the FE server itself to find out what the issue was.
First thing that was noticed after logging into the FE server was that the Skype4B Front End service was not running on all the FE servers. Therefore there was no routing group quorum to get the entire pool running, which in this case comprised of 3 FE servers. Recall that for a FE Pool of 3 FE servers, we need all 3 FE pools to be started in order to achieve routing group quorum for the pool to be started:
At this stage, running the Deployment Wizard and running the '3. Request, Install or Assign Certificates' step clearly showed that the default certificate was missing along with the OAuth certificate:
To verify that the certificates were indeed expired, we open the certificates MMC and confirm that the default certificate had expired on 3 Jan 2016 while the oAuth cert had expired earlier on 26 Dec 2015:
To resolve this problem, we go back to the Certificate Wizard within the Deployment Wizard and select the three checkboxes under 'Default certificate' and click 'Request' as shown below:
This will bring up the Certificate Request page where w need to fill in the relevant details as well as select one or all of the SIP domains which we want a SAN entry for. Note that the SAN list will be automatically populated depending on the SIP domains that we select. To continue we click 'Next':
The subsequent steps are pretty straightforward and we just need to click 'Next' to continue the process:
Once we complete the certificate assignment, we should return to the certificate wizard and see a green check mark against the new Default FE certificate as shown below. Note the expiry date is 2 years from today:
This completes the renewal of the Default certificate on FE1. We now need to perform the same for FE2 and FE3, and since the steps are the same, we shall not repeat them again. Next, we proceed to renew the oAuth certificate for server to server communications. As shown below, on the certificate wizard, we select the OAuthTokenIssuer certificate and click 'Request' to begin the process:
In the next screen, it looks similar to the previous request however note that the SAN list is fixed and cannot be changed:
The subsequent steps are also straighfoward and we just need to click 'Next' to continue:
After assigning the oAuth certificate, we are returned to the Certificate Wizard and this time we see all green check marks on all certificates:
Finally, we are ready to start up the FE Pool. The easiest way to do this, instead of rebooting all 3 FE servers manually, is to open the Skype4B management shell on one of the FE servers and run the 'Start-CsPool' cmdlet as shown below. The process will take several minutes and the window will display update status information of the startup process. There's no need to panic if we see any Failed messages at this stage. Simply wait for the pool to go through the startup process:
Once the startup process completes, we can see the status of all 3 FE servers as 'Running' which is a good indication that everything went well and smoothly:
At this point, our Skype4B FE Pool is up and running and we can once again sign in from the Skype4B clients, IP Phones and Video Endpoints. As can be seen, renewing expired certificates on the FE Pool is not all that difficult or complicated as it may seem to be.
8/4/2016 08:53:58 am

Nice, You make me deploy a local certificate beside a public certicate... Nice step by step ... mess with my sfb deployment.

8/5/2016 12:05:14 am

Hi Vinicius
These steps are for renewing the internal Skype for Business certificates using an internal CA. If you are using a public certificate for your front-end servers then the steps will be slightly different.

11/21/2018 04:54:37 am

No one is making you do anything here..

11/21/2018 04:57:01 am

Many thanks for this.
Had an issue where both the Default certificate + OAuthTokenIssuer certs had expired. Having no experience of skype for business this helped me to get them renewed and assigned!

3/4/2020 05:42:48 am

I had a problem with certificates from lync this morning and your article helped.
Thanks a lot.

4/5/2020 04:06:48 pm

Hey! This helped me a lot, thanks.

7/20/2020 11:47:45 pm

Thanks, it's help

10/23/2020 03:07:52 pm

You post make my day, Thanks


Your comment will be posted after it is approved.

Leave a Reply.

The Get-CsClientCertificate cmdlet provides a way for administrators to retrieve information about the Skype for Business Server client certificates that have been issued to their users. This information includes both the date and time that the certificate was issued in addition to the date and time when the certificate will expire. Note: If you have an older version of Skype for Business or Lync, 16.0 should be listed as 15.0. Create a new DWORD 32-bit value called “DisableServerCheck” and set the “Data” to “1“. Now close out of the Registry Editor and give it a try. Skype For Business should work just fine now with OCS. Over the weekend, some customers using Macs may have started seeing expired or invalid certificate warnings when trying to use Sprout Social. This is a problem caused by an expired intermediate certificate issued by DigiCert, the company that Sprout Social and many other websites use to get SSL certificates. Aditya is a self-motivated information technology professional and has been a technology writer for the last 7 years. He covers Internet services, mobile, Windows, software, and How-to guides.

-->

Original KB number: 10054

Summary

Some users, who use Skype for Windows, at the start of the program, encounter an error that the date and time are incorrect, when you must put the correct date and time for the authorization in Skype. Set the correct date and time on your device to sign in to Skype.

Note

  • To use this guide, you must have a Skype for Business sign-in name and password from an organization that uses Microsoft 365 Apps for business.
  • If you're an Office 365 admin, see Troubleshooting Skype for Business Online sign-in issues for admins.

We'll begin by asking you questions about your installation and the symptoms you're experiencing. Then we'll take you through a series of troubleshooting steps and configuration checks that are specific to your situation.

Important

Some troubleshooting steps are different depending on the type of installation you have. Please complete each troubleshooting step, even if it doesn't seem to apply to you.

The amount of time you spend will depend on the type of installation you have, and the causes of your sign-in issues.

Test your sign-in credentials

The first step is to try to sign in with your credentials in another location: Microsoft 365 Web Scheduler.

In most cases, both your sign-in address and user name look like one of these examples:

  • someone@example.com
  • someone@example.onmicrosoft.com

Can you sign in to Microsoft 365 Web Scheduler at https://sched.lync.com?

  • If yes, see Sign in with your corrected sign-in address.
  • If no, see Can't sign in to Microsoft 365 Web Scheduler.
  • If you forgot your password, see Contact your workplace technical support for a new password.

Sign in with your corrected sign-in address

If you're able to successfully sign in to Microsoft 365 Web Scheduler, try signing in again with the same type of credentials:

someone@example.com or someone@example.onmicrosoft.com

Were you able to sign in?

  • If yes, congratulations, you've resolved your sign-in issue!
  • If no and you need both a sign-in address and user ID, see Enter your user ID.
  • If no, and you got some other error, see Contact your workplace technical support for a new password.

Contact your workplace technical support for a new password

If you've forgotten your password or it's no longer working, use the Microsoft Online Password Reset site to request a new password from your workplace technical support team- typically the people who set up your account for you.

Important

If the password reset site doesn't work for you, contact your workplace tech support team directly.

Once you have a new password, try signing in again.

Did this solve your problem?

  • If yes, congratulations, you've resolved your sign-in issue!
  • If no, see Sign in on another device.

Sign in on another device

Are you able to sign in on another computer, or on a tablet or smartphone?

  • If yes, see Type of device.
  • If no, see Sign in on another network.
  • If you don't have access to another device right now, Type of device.

Sign in on another network

Can you sign in on a different network-for example, at home, or at a public wireless access point?

  • If yes, see Contact your workplace technical support
  • If no, see Type of device that you use to sign in.
  • If you don't have access to a different network right now, see Contact your workplace technical support

Type of device

What type of devices are you using to sign in?

  • For Windows computer, laptop, or tablet, see Synchronize your system clock with the network (Windows computer or laptop).
  • For Mac computer or laptop, see Synchronize your system clock with the network (Mac computer or laptop).
  • For Smartphone, see Update Skype for Business on the smartphone or tablet.
  • For iPad or Android tablet, see Update Skype for Business on the smartphone or tablet.

Type of device that you use to sign in

If you can't sign in on another network, the issue might be with the client you're using.

What type of devices are you using to sign in?

  • For Windows computer, laptop, or tablet, see [- If no, see Delete Skype for Business sign-in information.
  • For Mac computer or laptop, see Delete Skype for Business for Mac sign-in information.
  • For Smartphone, see Configure Skype for Business Online connection settings manually (Skype for Business for mobile devices).
  • For iPad or Android tablet, see Configure Skype for Business Online connection settings manually (Skype for Business for mobile devices).

Synchronize your system clock with the network (Windows computer or laptop)

Make sure your system clock shows the correct time, and then try signing in again.

Details

Update your computer's system time:

Windows 8

  1. Go to a web site that shows Coordinated Universal Time (UTC).

  2. Go to Setting > PC Settings > Time and Language.

  3. Note your UTC offset, and compare your device's time to that shown on the website.

If you need to update your device's time:

  1. Turn off Set time automatically and tap Change.
  2. Update the time and tap Change.
  3. Try signing in again.

Windows 7

  1. Go to a web site that shows Coordinated Universal Time (UTC).

  2. Go to Control Panel > Date and Time, and note the UTC offset for your location.

  3. If you need to, choose Change date and time and update your computer's clock.

  4. Try signing in again.

Did this solve your problem?

  • If yes, congratulations, you've resolved your sign-in issue!
  • If no, see Delete Skype for Business sign-in information.

Desktop Setup

Make sure you have the most current version of the Microsoft Online Services Sign-in Assistant.

Did this solve your problem?

  • If yes, congratulations, you've resolved your sign-in issue!
  • If no, see Delete Skype for Business sign-in information.

Update Skype for Business

Make sure the user has the most current version of Skype for Business.

Did this solve your problem?

  • If yes, congratulations, you've resolved your sign-in issue!
  • If no, see Delete Skype for Business sign-in information.

Delete Skype for Business sign-in information

For more information, see How to troubleshoot being unable to sign in to Skype for Business.

Did this solve your problem?

  • If yes, congratulations, you've resolved your sign-in issue!
  • If no, see Configure connection settings manually.

Synchronize your system clock with the network (Mac computer or laptop)

Make sure your system clock shows the correct time, and then try signing in again.

Details

Follow these steps:

  1. Go to a web site that shows [Coordinated Universal Time (UTC).
  2. Go to Apple > System Preferences.
  3. In the Date & Time pane, select the Date & Time tab.
  4. Note the UTC offset for your location.
  5. If you need to, update your computer's clock, and then try signing in again.

Did this solve your problem?

  • If yes, congratulations, you've resolved your sign-in issue!
  • If no, see Update Skype for Business.

Update Skype for Business

Make sure your computer has the most recent version of Skype for Business.

Did this solve your problem?

  • If yes, congratulations, you've resolved your sign-in issue!
  • If no, see Delete Skype for Business sign-in information.

Delete Skype for Business for Mac sign-in information

Make sure that previously saved sign-in information isn't blocking your current sign-in attempt.

Details

First, delete the following:

  • Users/Home Folder/Library/Caches/com.microsoft.Skype for Business
  • Users/Home Folder/Documents/Microsoft User Data/Microsoft Skype for Business History

Then delete any corrupted or cached certificates:

  1. Open the Keychain Access certificate management utility. To do this, in Finder, select Applications, select Utilities, and then select Keychain Access. Or, search for Keychain Access by using Spotlight.
  2. In the left pane, select login, and then select Certificates.
  3. In the right pane, find any certificate named Unknown or Communications Server, select it, and then delete it. Note that you may have to unlock your keychain by using your password.
  4. Close Keychain Access.
  5. Restart Skype for Business for Mac.

Did this solve your problem?

  • If yes, congratulations, you've resolved your sign-in issue!
  • If no, see Configure connection settings manually.

Update Skype for Business on the smartphone or tablet

Go to the app store for your device and check for updates to the currently installed version of Skype for Business.

Error

Did this solve your problem?

  • If yes, congratulations, you've resolved your sign-in issue!
  • If no, see Configure Skype for Business Online connection settings manually (Skype for Business for mobile devices).

Configure Skype for Business connection settings manually

Manually add Skype for Business server settings and try signing in again.

Details

Manually add Skype for Business server settings:

  1. Go to Skype for Business options > Personal.

  2. Under My account, select Advanced, and then select Manual configuration.

  3. Enter sipdir.online.lync.com:443 in both boxes, and then select OK > OK.

  4. Sign out, and then try signing back in.

Did this solve your problem?

Skype For Business Mac Certificate Error

  • If yes, see Issue temporarily resolved (Clients and devices).
  • If no, see Contact your workplace technical support.

Configure Skype for Business connection settings manually

Manually add Skype for Business server settings, and then try signing in again.

Details

Ask the user to follow these steps:

  1. Select Advanced.
  2. Under Authentication, clear the Use Kerberos check box.
  3. Under Connection Settings, select Manual configuration.
  4. In both the Internal Server Name box and the External Server Name box, type or paste sipdir.online.lync.com:443.
  5. Select OK.

Did this solve your problem?

  • If yes, see Issue temporarily resolved (Clients and devices).
  • If no, see Contact your workplace technical support.

Issue temporarily resolved (Clients and devices)

We're glad to hear you're back in service.

To help your organization find out why Skype for Business can't automatically sign in, contact your workplace technical support-typically the person who sent you email about how to get set up with Office 365.

Configure Skype for Business Online connection settings manually (Skype for Business for mobile devices)

Manually add Skype for Business Online server settings, and then try signing in again.

Details

Manually add Skype for Business server settings:

  1. On the Skype for Business sign-in screen, tap More Details (Windows) or Show Advanced Options (iPhone, iPad, or Android).
  2. Turn off Auto-Detect Server.
  3. In both the Internal Discovery Name and External Discovery Name boxes, enter https://webdir.online.lync.com/Autodiscover/autodiscoverservice.svc/Root
  4. Select Sign In.

Did this solve your problem?

  • If yes, see Issue temporarily resolved (Clients and devices).
  • If no, see Configure Skype for Business Server connection settings manually (Skype for Business for mobile devices).

Contact your workplace technical support

We're sorry, but we couldn't resolve your sign-in issue. For more troubleshooting, contact your workplace technical support-typically the person who sent you email about how to get set up with Office 365.

Enter your user ID

If Skype for Business asks you for your user ID, in most cases it is the same as your sign-in address-for example, bobk@contoso.com.

If that doesn't work, try the same credentials you use when signing in to your organization's network-for example, CONTOSObobk.

Did this solve your problem?

  • If yes, congratulations, you've resolved your sign-in issue!
  • If no, see Sign in on another device.

Update Skype for Business Windows Store app

Make sure you have the most current version of Skype for Business Windows Store app:

  1. On the Start screen, tap Store

  2. Search for Skype for Business, and install the update if one is available.

  3. Try signing in again.

Did this solve your problem?

  • If yes, congratulations, you've resolved your sign-in issue!
  • If no, see Delete Skype for Business sign-in information.

Clear the DNS cache

Make sure that previously save network information is not blocking your sign-in attempt, and then try signing in again.

Windows 8

Clear the DNS cache (summary)
  • Run the Command prompt app as an administrator, and enter ipconfig /flushdns.
Clear the DNS cache (details)
  1. Swipe in from the right or point to the upper right of the screen.
  2. Choose Search, and then type command.
  3. Select the Command prompt app, and then swipe up from the bottom or right click for options.
  4. Choose Run as administrator, and then choose Yes.
  5. Enter ipconfig /flushdns.

Windows 7, Windows Vista, Windows XP, Windows Server 2008, or Windows Server 2003

Clear the DNS cache
  1. Select Start, and in the Search programs and files box, enter cmd.exe.
  2. Right-click cmd.exe in the search list, and then select Run as administrator.
  3. Enter ipconfig /flushdns.

Did this solve your problem?

  • If yes, congratulations, you've resolved your sign-in issue!
  • If no, see Configure connection settings manually.

Can't sign in to Microsoft 365 Web Scheduler

What kind of error did you get when you tried to sign in to https://sched.lync.com?

Configure Skype for Business Server connection settings manually (Skype for Business for mobile devices)

Skype For Business Mac Date Time Certificate Error Codes

If the Skype for Business Online manual configuration didn't work, your organization may be using Skype for Business Server.

  • First try signing in with this Skype for Business Server setting: https://webdir.example.com/Autodiscover/ autodiscoverservice.svc/Root where example.com is your domain name.
  • Then try signing in with this Skype for Business Server setting: https://webext.example.com/Autodiscover/ autodiscoverservice.svc/Root where example.com is your domain name.

Details

Manually add Skype for Business server settings:

  1. On the Skype for Business sign-in screen, tap More Details (Windows) or Show Advanced Options (iPhone, iPad, or Android).
  2. Turn off Auto-Detect Server.
  3. In both the Internal Discovery Name and External Discovery Name boxes, enter the webdir server address on the left. For example, if your domain name is contoso.com, enter https://webdir.contoso.com/Autodiscover/autodiscoverservice.svc/Root.
  4. Select Sign In.
  5. If you are not able to sign in, enter the webext server address on the left in both boxes. For example: https://webext.contoso.com/Autodiscover/autodiscoverservice.svc/Root.
  6. Select Sign In.

Skype For Business Mac Date Time Certificate Error

Did this solve your problem?

Skype For Business Mac Date Time Certificate Error Code

  • If yes, see Issue temporarily resolved (Clients and devices).
  • If no, see Contact your workplace technical support.