Skype for Business 2015 Assigning Oaut certificate

Question

When i try to assign a new oauth certificate i receive this error: Error: The specified directory service attribute or value does not exist.

Error: The specified directory service attribute or value does not exist.  
▼ Details 
└ Type: COMException 
└ ▼ Stack Trace 
    └   at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) 
at System.DirectoryServices.DirectoryEntry.Bind() 
at System.DirectoryServices.DirectoryEntry.get_IsContainer() 
at System.DirectoryServices.DirectoryEntries.ChildEnumerator..ctor(DirectoryEntry container) 
at Microsoft.Incubation.Crypto.GroupKeys.ADRepository.EnumerateKeys() 
at Microsoft.Incubation.Crypto.GroupKeys.DKMBase.FindNewestKey() 
at Microsoft.Incubation.Crypto.GroupKeys.DKMBase.GetCurrentKeyAndUpdate(KeyPolicy& keyPolicy) 
at Microsoft.Incubation.Crypto.GroupKeys.DKMBase.Protect(MemoryStream plaintext) 
at Microsoft.Rtc.Management.Internal.KeyManagement.GroupKeyWrapper.Encode(Byte[] inBytes) 
at Microsoft.Rtc.Management.Deployment.Core.Certificate.SetCMSCertificate(IScopeAnchor scope, X509Certificate2 foundCert, X509Certificate2Collection certs, Nullable`1 effectiveTime, Boolean isRoll) 
at Microsoft.Rtc.Management.Deployment.Core.Certificate.SetCMSCertificate(IScopeAnchor scope, String thumbprint, Nullable`1 effectiveTime, Boolean isRoll) 
at Microsoft.Rtc.Management.Deployment.Tasks.SetCertificateTask.Action() 
at Microsoft.Rtc.Management.Internal.Utilities.LogWriter.InvokeAndLog(Action action) 


   3/12/2021 2:12:23 PM   Error 

 └    Error: An error occurred: "System.Runtime.InteropServices.COMException" "The specified directory service attribute or value does not exist.

I have no clue what the issue is here. Can someone help me out? We are running Skype for Business server 2015 CU11.

Answer 1

@Mark Bolten ,

Do you mean that you are trying to renew the certificates in Skype for Business server 2015?

Do you check if the information is correct in Certificate Request page?

If the OAuthTokenIssuer certificate is assigned properly in other servers, you just need to restart the “Skype for Business Server Replica Replicator Agent” service on other servers.

---

If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi,

I have a similar error here: https://learn.microsoft.com/en-us/answers/questions/314771/assigning-skype-for-business-2015-outh-cert-fail.html

@Mark Bolten - Did you manage to assign the Oauth cert?

I get the same (useless) suggestions in my thread as you do.

Answer 3

This is how I solved it, this may help you as well. Just make sure you have a good backup in place, just in case.

1. Removed the current Oauth Certificate that was about to expire via the GUI.
2. Deleted all AD objects via ADSI Edit within the domain.local/Program Data/Microsoft/Distributed Keyman/
   This is where all Oauth certificates are stored (including present).
3. Forced AD sync from DC via cmd: repadmin /syncall /AdeP
4. At the Front-End server Skype shell: Enable-CsAdForest
   Enable-CsAdDomain

This will restore the corrupted AD objects.

5. Went to the GUI to assign my new Oauth certificate (request a new one as well if you didn't do that before).

New certificate is in place. If you have several Front-Ends - reboot them.