As of the 8.1 firmware release of Polycom RealPresence Collaboration Server (RMX) SSL certificates are now managed using a completely different method than used with previous versions (7.6 and older).

When integrating an RMX with Lync Server an SSL certificate must be issued to and installed on the RMX so that secure MTLS communications with the Lync Servers is possible.  In older firmware versions the Certificate Method option was located in the SIP Servers settings window under the IP Network Services properties and provided the ability to import either a package of certificates (.PFX) or individual certificate files (.PEM), as well as directly issue new requests

But when viewing the same properties window using RMX Manager 8.1 what is immediately noticeable is that the Certificate Method option is missing and in its place are a group of new certificate validation options.

This is clearly by design, as the RMX now utilizes a separate menu for managing all certificates. For each IP Network Service object in the RMX it is now possible to control these new Certificate Revocation features, but for requesting, importing, and generally managing the certificates themselves the Certification Repository menu now handles this.

Importing Certificates

This method is the most common approach when dealing with Lync Server integration as the official Polycom integration guide shows how to use Internet Information Server Manager to create a simple online certificate request against a Windows Enterprise CA.

The same instructions as documented for previous RMX versions would still be followed, but with two important changes:

1. 1. The certPassword.txt file is no longer used.  That step in the official documentation can be ignored from this point on as the import process has been simplified to prompt for the PFX password directly.
   2. The PFX package is not imported on the SIP Servers properties window but in the Personal Certificate Repository menu.

• Following the Polycom UC Deployment Guide for Microsoft create a new certificate request using IIS Manager, issue the request to the Enterprise Windows CA, and then export the certificate, private key, and root CA certificate to a PFX file as instructed.

• Using the RMX Manager 8.1 (or newer) connect to an RMX also running firmware version 8.1 (or newer) and browse to the Setup > RMX Secured Communication > Certification Repository menu.

• Highlight Personal Certificates and verify the existing certificates.  If the RMX is configured with factory defaults then a self-signed certificate would be listed here as assigned to each interface.

• Click the Add button to open the Create Personal Certificate window and change the Certificate Method to PEM/PFX.  Enter the Password which was used to protect the PFX package and then click Send Certificate.

• In the Install File window browse to the previously exported PFX certificate package and click Yes to upload the certificate, private key, and CA chain into the RMX.

If successful the response should be “Message file transferred successfully” and RMX Manager will request to reboot the RMX to apply the new certificate to the SIP services.

Requesting Certificates

This method is seldom used when integrating with Lync Server, especially when a private Certificate Authority is used to issue SSL certificates as covered in the previous section.  Yet when submitting requests to a public CA then creating the request directly on the RMX is a viable alternative method.

• Using the RMX Manager 8.1 (or newer) connect to an RMX also running firmware version 8.1 (or newer) and browse to the Setup > RMX Secured Communication > Certification Repository menu.

• Highlight Personal Certificates and verify the existing certificates.  If the RMX is configured with factory defaults then a self-signed certificate would be listed here as assigned to each interface.

• Click the Add button to open the Create Personal Certificate window.

• Select IP Network Services for the Network Service Name and then click the Create Certificate button to open the following Create Certificate Request window and then fill out the details as appropriate for the certificate’s needs.

In the scenario of integrating an RMX with Lync Server populate the Common Name (DNS) field using the Fully Qualified Domain Name previously defined for the RMX’s signaling interface (e.g. rmx.schertz.name).  Leave the Subject Alternative Name (SAN) field unchecked as no SAN entries are used.  For the Hash Method either SHA-1 or SHA-256 can be selected as both the RMX and Lync Server support each method.

• When the form is completed click the Send Details button to create the certificate request text.  Then click Copy Request to send the request data to the clipboard.

• Paste the data into a new text file (and save) or paste the string directly into the appropriate web interface or certificate management tool to submit the request to the Certificate Authority of choice.

In this example the certificate request was submitted to DigiCert and the response was received shortly after the domain used in the Common Name field was validated by them.  Depending on the CA the response may come in the form of an individual certificate file (e.g. .CER) or a package (.PFX) containing the issued certificate as well as the certificate chain of any issuing and/or root CA servers.  In either case the individual requested certificate needs to be separated and accessed in a Base 64 format which can be viewed in plain text and copied to the clipboard.

• Click Close on the previous window in the RMX Manager to return to the Create Personal Certificate menu.

• Click Send Certificate to open the Send Certificate window.  Copy the issued certificate text to the clipboard (not the certificate request data created earlier, that will not work) and paste into this window.

• Click the Send Certificate button to complete the process and import the certificate into the RMX, replacing the self-signed certificate in this example.

At this point RMX Manager will request to reboot the RMX to apply the new certificate to the SIP services.