'There was a problem verifying the certificate server. Check your device's clock setting, or contact your support team.' I have removed the SfBfM-related files from /Library, reinstalled Skype and (what I think are the proper) certificates for our server. When trying to sign in without using company X's VPN (how I usually sign on), I get 'You didn't get signed in. It might be your sign-in address or logon credentials, so try those again. If that doesn't work, contact your support team'. When using the VPN, I get 'there was a problem verifying the certificate from the server'.

• Skype For Business Certificate Error
• Skype For Business Server Certificates

To troubleshoot Skype for Business Online sign-in errors, start by eliminating the most common causes of sign-in difficulty. If necessary, you can then follow specific resolution steps based on the type of error. If the user still cannot sign in, collect additional information, and then seek additional help.

What do you want to do?

Check for common causes of Skype for Business Online sign-in errors

Most sign-in issues can be traced to a small number of causes, and many of these are easy to correct. The table below lists some common causes of sign-in errors and some steps you or the users can take to resolve them.

To troubleshoot Skype for Business Online sign-in errors, start by eliminating the most common causes of sign-in difficulty. If necessary, you can then follow specific resolution steps based on the type of error. If the user still cannot sign in, collect additional information, and then seek additional help.

Follow resolution steps for a specific error (Enterprise only)

Important

These instructions are intended primarily for Microsoft Office 365 Plan E customers. If you are an Office 365 Plan P customer, continue to the following section, Collect more information and seek additional help.

If the user cannot sign in after you have tried the suggestions in the previous section, then you can do additional troubleshooting based on the type of error. The table below lists the most common error messages and possible causes. Following the table are detailed procedures to address each issue.

Add a firewall entry for msoidsvc.exe to your proxy server

This procedure is a possible fix for the following error message: Sign-in address not found.

Skype For Business Certificate Error

Note

The following steps assume you are using Microsoft Forefront Threat Management Gateway (TMG) 2010. If you have a different web gateway solution, use the settings described in step 4 below.

To create an application entry for Msoidsvc.exe in Forefront TMG 2010, follow these steps:

1. In the Forefront left pane, click Networking.

2. Click the Network tab. Under the Tasks tab in the right pane, click Configure Forefront TMG Client Settings.

3. In the Forefront TMG Client Settings dialog box, click New.

4. In the Application Entry Setting dialog box, configure the following rules:

For details, see the Microsoft Knowledge Base article 2409256, You cannot connect to Skype for Business Online because an on-premises firewall blocks the connection.

Update DNS settings

If your organization has a custom domain, this procedure is a possible fix for the following error message: Server is temporarily unavailable.

• Contact your domain name registrar for information on how to add the following CNAME record to your domain:

  • DNS record type: CNAME

  • Name: sip

  • Value/Destination: sipdir.online.lync.com

For details, see the Microsoft Knowledge Base article 2566790, Troubleshooting Skype for Business Online DNS configuration issues in Microsoft 365 or Office 365.

Install a third-party SSL certificate on your ADFS server

To install a third-party SSL certificate on your Active Domain Federation Services (ADFS) server, follow these steps:

1. Obtain an SSL certificate from a third-party certification authority such as VeriSign or Thawte.

2. Install the certificate on your ADFS server by using the ADFS management console.

Update security credentials

This procedure is a possible fix for the error message Problem acquiring a personal certificate required to sign in.

To eliminate possible certificate or credential problems, first renew the user's certificate in Windows Certificate Manager. To do this, follow these steps:

1. Open Windows Certificate Manager. To do this, click Start, click Run, type certmgr.msc, and then click OK.

2. Double-click Personal, and then double-click Certificates.

3. Sort by the Issued By column, and then look for a certificate that is issued by Communications Server.

4. Right-click the certificate, and then click Delete.

Next, if the user is running Windows 7, remove their stored credentials in Windows Credential Manager. To do this, follow these steps:

1. Click Start, click Control Panel, and then click Credential Manager.

2. Locate the set of credentials that is used to connect to Skype for Business Online.

3. Expand the set of credentials, and then click Remove from Vault.

4. Sign in again and reenter the user's credentials.

Finally, if the user still cannot sign in after you've updated their credentials, try deleting the RSA folder on the user's computer, because it could be blocking completion of the user authentication process:

1. Sign in to the user's computer using an administrator account.

2. If necessary, turn on the folder view option Show hidden files.

3. Type the following into the address bar of File Explorer: C:Documents and SettingsUserNameApplication DataMicrosoftCryptoRSA, where UserName is your Windows sign-in name.

4. Delete any folder that begins with the name S-1-5-21- followed by a string of numbers.

Modify TrustModelData registry keys

When a user signs in for the first time, they may receive a dialog box that contains something like the following: Cannot verify that the server is trusted for your sign-in address. Connect anyway? This is a security feature, and not an error. However, you can prevent the dialog box from appearing by using a Group Policy Object (GPO) to update users' machines with your domain name before they sign in for the first time. To accomplish this, do the following:

• Create and deploy a GPO that appends your Skype for Business domain name—for example, domainName.contoso.com—to the current value of HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftCommunicatorTrustModelData.

Important

You must append your domain name to the existing value, not simply replace it.

For details, see the Microsoft Knowledge Base article 2531068, Skype for Business (Lync) cannot verify that the server is trusted for your sign-in address.

Update user settings in Active Directory

If your organization had a previous installation of Microsoft Office Communications Server or Microsoft Lync Server 2010, you may not have deleted your users from the server before decommissioning it. As a result, the msRTCSIP-UserEnabled attribute is still set to FALSE in Active Directory Domain Services.

To fix this issue, follow these steps:

1. Update the msRTCSIP-UserEnabled attribute for all affected users to TRUE.

2. Rerun the Microsoft Online Services Directory Synchronization Tool (DirSync). For details, see AIntegrate your on-premises directories with Azure Active Directory.

To troubleshoot Skype for Business Online sign-in errors, start by eliminating the most common causes of sign-in difficulty. If necessary, you can then follow specific resolution steps based on the type of error. If the user still cannot sign in, collect additional information, and then seek additional help.

Use the Microsoft Support troubleshooting guide

If you're still not able to resolve the user's sign-in problems, review the suggestions in Microsoft Knowledge Base article 2541980, How to troubleshoot sign-in issues in Skype for Business Online.

Collect more information and seek additional help

If you've followed the guidance above and still can't resolve your sign-in issues, you must collect additional information and contact technical support. To do this, follow these steps:

1. Obtain the log files and Windows Event log details from the user's machine. For step-by-step instructions, see the end-user help topic Turn on error logs in Lync.

2. Send the log files and detailed information about the error to Microsoft technical support.

You may be asked to supply additional diagnostic information by installing the Microsoft Online Services Diagnostic and Logging (MOSDAL) Support Toolkit on the affected user's machine. For details, see Using the MOSDAL Support Toolkit.

To troubleshoot Skype for Business Online sign-in errors, start by eliminating the most common causes of sign-in difficulty. If necessary, you can then follow specific resolution steps based on the type of error. If the user still cannot sign in, collect additional information, and then seek additional help.

Related topics

Changing an expired SSL certificate is easy in Exchange 2016 using the EMC. A simple click or two, and boom… new certificate!

Unless you have integrated Skype for Business IM into your OWA.

Symptoms
1st Symptom: User Complaints
2nd Symptom: Your exchange logs the following event:

The certificate specified by the InstantMessagingCertificateThumbprint parameter of the Outlook Web App virtual directory wasn’t found in the local certificate store.
Certificate thumbprint:

Yup.. you have a couple of more steps to complete.

STEP#1: Get the new thumbprint

1. Launch Exchange Management Shell as an Administrator
2. Execute
   Get-ExchangeCertificate
3. Copy the Thumbprint of the certificate that has registered the “W” service
   NOTE: That same certificate may have registered other services like the certificate example below, which has registered IPUWSC services.
   

STEP#2: Update the OWA virtual directory with the new thumbprint

1. Launch Exchange Management Shell as an
   Administrator
2. Execute
   get-owavirtualdirectory | Set-OwaVirtualDirectory -InstantMessagingCertificateThumbprint [THE NEW THUMBPRINT]

Skype For Business Server Certificates

STEP#3: Update the OWA configuration file

1. Open the OWA configuration file located at
   C:Program FilesMicrosoftExchange ServerV15ClientAccessOWAweb.config
2. Search the configuration file for “IMCertificateThumbprint”
   Important: If the key does not exist in the web.config, proceed to STEP#3A below
3. Change the key thumbprint to the new thumbprint value
   <add key=”IMCertificateThumbprint” value=”[THE NEW THUMBPRINT” />
4. Restart IIS and test IM in OWA
5. Your Done! Stop here!

STEP#3A: Update Setting Overrides

1. Launch Exchange Management Shell as an Administrator
2. Execute
   Get-SettingOverride

1. You should get an output like the following
   Closely note the following values
   – Id {In the example above, the value is OWA-SKYPE-INTEGRATION
   – Parameters, specifically the IMServerName value {In the example above, the value is SRVSKYPE15FE.corp.armgasys.com
2. Execute
   Set-SettingOverride -Identity [ID NAME] -Parameters @(“IMServerName=[SERVER NAME]”,”IMCertificateThumbprint=[THE NEW THUMBPRINT]”)
3. Make sure everything is refreshed by executing the following command
   Get-ExchangeDiagnosticInfo -Server $ENV:COMPUTERNAME -Process Microsoft.Exchange.Directory.TopologyService -Component VariantConfiguration -Argument Refresh
4. Restart IIS and test IM in OWA

Good Luck!