We've just deployed an on premise Lync 2013 environment (upgrade from 2010) using F5 BIG-IP LTM as the Reverse Proxy. This was deployed using the updated Lync 2013 iApp template. I cannot get an iOS device to connect, however Android, (some) Mac OSX Lync clients, Windows Phone 8, external Windows 2013 clients can. We have a Microsoft MVP onsite (has been for 3 weeks) and we can't seem to work it out either. I found an article where a user connected to the console of the F5 and run the following command: openssl s_client -host lync.domain.com -port 443 it gives us the output of verifying the certificate chain. I get the error: Verify return code: 20 (unable to get local issuer certificate) The current certificate configuration is: Edge Servers have a wildcard external domain certificate by DigiCert. Front End Servers have an internal certificate provided by our Internal CA. The F5 have the wildcard certificate in the SSL profile as requested by the iApp template. I have pushed all of the above certs (Internal Root CA cert, Internal Intermediate CA cert, Front End Cert, External DigiCert CA, Wildcard Cert) to the iOS device using our MDM server. I checked the SSL certificate list on the F5 Appliance and from what I can see all the certificates are installed, although they are not explicity connected to any of the iApp properties. We're pulling our hair out! I'm still pretty green with F5. There are no errors in the console of the iOS device by connecting the device to iPhone Configuration Utility. I can only assume theres something missing on the F5, and its likely to do with a certificate chain. No idea where to from here.

I have not checked the latest version of the template, but in 1.2.1 it did ask about the chain in the setup, and left me with an ssl profile that had no chain. You can try and manually set it. Go into the Application Services, click your Lync deployment and go to the Properties tab. Uncheck Strict updates and click update. From there go to the Client SSL Profile(mine is named Lync2013_edge_external_ip_reverse_proxy_client_ssl) and set the chain(you'll have to have imported it first as a certificate) If that solves your problem, just be aware that if you modify the iApp config it may overwrite this change and you have to set it back manually.

Forum Discussion

Pete_L_112517

Nimbostratus

Jul 29, 2014

Lync 2013 Devices using F5 as Reverse Proxy can't connect

We've just deployed an on premise Lync 2013 environment (upgrade from 2010) using F5 BIG-IP LTM as the Reverse Proxy. This was deployed using the updated Lync 2013 iApp template.

I cannot get an iOS device to connect, however Android, (some) Mac OSX Lync clients, Windows Phone 8, external Windows 2013 clients can.

We have a Microsoft MVP onsite (has been for 3 weeks) and we can't seem to work it out either. I found an article where a user connected to the console of the F5 and run the following command:

openssl s_client -host lync.domain.com -port 443

it gives us the output of verifying the certificate chain. I get the error:

Verify return code: 20 (unable to get local issuer certificate)

The current certificate configuration is:

Edge Servers have a wildcard external domain certificate by DigiCert.
Front End Servers have an internal certificate provided by our Internal CA.
The F5 have the wildcard certificate in the SSL profile as requested by the iApp template.
I have pushed all of the above certs (Internal Root CA cert, Internal Intermediate CA cert, Front End Cert, External DigiCert CA, Wildcard Cert) to the iOS device using our MDM server.

I checked the SSL certificate list on the F5 Appliance and from what I can see all the certificates are installed, although they are not explicity connected to any of the iApp properties.

We're pulling our hair out! I'm still pretty green with F5.

There are no errors in the console of the iOS device by connecting the device to iPhone Configuration Utility.

I can only assume theres something missing on the F5, and its likely to do with a certificate chain. No idea where to from here.

mimlo_61970
Jul 29, 2014
I have not checked the latest version of the template, but in 1.2.1 it did ask about the chain in the setup, and left me with an ssl profile that had no chain.

You can try and manually set it. Go into the Application Services, click your Lync deployment and go to the Properties tab. Uncheck Strict updates and click update.

From there go to the Client SSL Profile(mine is named Lync2013_edge_external_ip_reverse_proxy_client_ssl) and set the chain(you'll have to have imported it first as a certificate)

If that solves your problem, just be aware that if you modify the iApp config it may overwrite this change and you have to set it back manually.

mimlo_61970
Cumulonimbus
Jul 29, 2014
I have not checked the latest version of the template, but in 1.2.1 it did ask about the chain in the setup, and left me with an ssl profile that had no chain.

You can try and manually set it. Go into the Application Services, click your Lync deployment and go to the Properties tab. Uncheck Strict updates and click update.

From there go to the Client SSL Profile(mine is named Lync2013_edge_external_ip_reverse_proxy_client_ssl) and set the chain(you'll have to have imported it first as a certificate)

If that solves your problem, just be aware that if you modify the iApp config it may overwrite this change and you have to set it back manually.
- Pete_L_112517
  Nimbostratus
  Jul 30, 2014
  This is exactly the issue. I located this issue yesterday afternoon after posting the question here. Just came here to post the answer. It turned out I need to create a bundle (chain) certificate of: our wildcard external cert -> intermediate DigiCert CA -> DigiCert Root CA Thanks very much for your reply!
- mimlo_61970
  Cumulonimbus
  Jul 30, 2014
  Good to hear. I am in the middle of a 2013 deployment and expect I am about to run into the same problem. All your research into the nature of the problem will end up helping me more than I helped you.
- mikeshimkus_111
  Historic F5 Account
  Aug 06, 2014
  Hi there, I'm one of the maintainers of the Lync iApp template. There should be no question about intermediate cert in the v1.2.1 template (you can add it by disabling strictness, as you pointed out). This has been added in the v1.3.0 RC-1 version of the template that's up on DevCentral right now, and it does apply the chain cert in my testing. However, it looks like the chain cert is not visible in the web GUI. You can verify this by looking at the properties of the clientssl profile in tmsh. Can you confirm that you didn't see the chain cert in tmsh? thanks