Assigning Skype For Business 2015 Outh cert fail

Question

I am trying to renew our S4B Oauth Certificate, but it fails both in the GUI and in PowerShell.

The certificate issues without problem but when it tries to assign (set-cscertificate) it throws this error:

Command execution failed: Guid should contain 32 digits with 4 dashes (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx).

Via Powershell:

Set-CsCertificate : Command execution failed: Guid should contain 32 digits with 4 dashes (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx). At line:1 char:1 + Set-CsCertificate -Identity Global -Type OAuth -Thumbprint 77eb8f26eecc8c3149d04 ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ + CategoryInfo : InvalidOperation: (:) [Set-CsCertificate], FormatException + FullyQualifiedErrorId : ProcessingFailed,Microsoft.Rtc.Management.Deploy ment.SetCertificateCmdlet

Via GUI:

We have one Front-end, one Mediation and one Edge and Exchange 2013 On-Prem.

Skype for Business 2015 6.0.9319 (February 2021 CU)

Any ideas how to get it assigned?

Thanks!

Answer 1

For whom it may concern - here is how I solved it:

1. Removed the current Oauth Certificate that was about to expire via the GUI.
2. Deleted all AD objects via ADSI Edit within the domain.local/Program Data/Microsoft/Distributed Keyman/
   This is where all Oauth certificates are stored (including present).
3. Forced AD sync from DC via cmd: repadmin /syncall /AdeP
4. At the Front-End server Skype shell: Enable-CsAdForest
   Enable-CsAdDomain

This will restore the corrupted AD objects.

5. Went to the GUI to assign my new Oauth certificate (request a new one as well if you didn't do that before).

New certificate is in place. If you have several Front-Ends - reboot them.

Answer 2

Just for added info i had exact info and solution above worked for me, except i wasnt comfortable just deleting the objects in ADSI edit call me paranoid especially as i found that they were not easy to distinguish so deleting something i couldnt identify wasnt a risk i wanted to take

Below which sorted the issue, cobbled together from other bits of information from old Lync 2013 articles about possible AD sync issues

1) Removed the current Oauth Certificate that was about to expire via the GUI

2) Forced AD sync from DC via cmd: repadmin /syncall /AdeP

At the Front-End server Skype shell:

Enable-CsAdForest
Enable-CsAdDomain

3) Went to SFB GUI to assign my new Oauth certificate - requested a new one which assigned this time correctly with no error

4) New Certificate should then replicate from CMS to all other Front Ends on next replication run

To speed this up i ran an invoke-csmanagementstorereplication and then all certificate were allocated on the front end

5) You can also restart the Skype for Business replica service on Front Ends if needed

I believe the root of the problem is uncommitted AD objects in SFB hence the Enable ADForest and ADDomain commands

I was relived to sort this as there is not much info out there with this error and with SFB no longer in use as much, the various Blog articles on web are starting to become very thin on the ground

Answer 3

Hi @Sebastian

In this case, we firstly recommend you check if you select the correct CA in your Certificate Request page.

To restore the OAuth certificate, we simply need to restart the Lync/SfB Server Replica Replicator Agent. During start-up the Replica Replicator Agent, it will add the OAuth certificate again to the Computer Certificate Store:

---

If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.