Hi all,
So in short:
SFB clients (Android, Windows Mobile, IOS) fails to connect when on internal network. Error message is network error, which is not correct, its just the client doesn't trust internal root CA. In earlier version you get an option to trust certificate anyway, but now this option is gone and users only get network error when they connect.
If they switch to Mobile data, it connects fine (since it will hit external 3rd part certificate).
Mobile and desktop client will query lyncidsoverinternal before lyncdiscover, either way it will also connect to Internal/external web services.
Only option for us here is to use 3rd part certificate on Frontend server and Edge server and it should also contain internal web service name and Lyncdiscoverinternal.
My main question is, why have Microsoft removed the option to accept internal certificate on mobile clients? This have been working fine before but failed lately with latest SFB mobile clients. The issue have also been on and off if you get this option or not. In Lync 2013 mobile client, this issue was also there but gone again after few updates.
Now we have to pay huge sum to get new certificate to contain lyncdiscoverinternal and internal web services. We have many sip domains so we will need a lot of SAN names.
Are there any workaround besides for us to buy new certificate to get mobile clients to work when on internal network?
It doesn't help to delete lyncdiscoverinternal record in DNS, since mobile clients will hit internal web services which is not in SAN name of our External certificate either.
Pushing out Root ca to all mobile clients is not an option as of now, since Intune is not ready yet and will take a while before its done.
Thanks!
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work