Skype for Business 2015 Assigning Oaut certificate

Mark Bolten 1 Reputation point
2021-03-12T13:33:00.903+00:00

When i try to assign a new oauth certificate i receive this error: Error: The specified directory service attribute or value does not exist.

Error: The specified directory service attribute or value does not exist.  
▼ Details 
└ Type: COMException 
└ ▼ Stack Trace 
    └   at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) 
at System.DirectoryServices.DirectoryEntry.Bind() 
at System.DirectoryServices.DirectoryEntry.get_IsContainer() 
at System.DirectoryServices.DirectoryEntries.ChildEnumerator..ctor(DirectoryEntry container) 
at Microsoft.Incubation.Crypto.GroupKeys.ADRepository.EnumerateKeys() 
at Microsoft.Incubation.Crypto.GroupKeys.DKMBase.FindNewestKey() 
at Microsoft.Incubation.Crypto.GroupKeys.DKMBase.GetCurrentKeyAndUpdate(KeyPolicy& keyPolicy) 
at Microsoft.Incubation.Crypto.GroupKeys.DKMBase.Protect(MemoryStream plaintext) 
at Microsoft.Rtc.Management.Internal.KeyManagement.GroupKeyWrapper.Encode(Byte[] inBytes) 
at Microsoft.Rtc.Management.Deployment.Core.Certificate.SetCMSCertificate(IScopeAnchor scope, X509Certificate2 foundCert, X509Certificate2Collection certs, Nullable`1 effectiveTime, Boolean isRoll) 
at Microsoft.Rtc.Management.Deployment.Core.Certificate.SetCMSCertificate(IScopeAnchor scope, String thumbprint, Nullable`1 effectiveTime, Boolean isRoll) 
at Microsoft.Rtc.Management.Deployment.Tasks.SetCertificateTask.Action() 
at Microsoft.Rtc.Management.Internal.Utilities.LogWriter.InvokeAndLog(Action action) 


   3/12/2021 2:12:23 PM   Error 

 └    Error: An error occurred: "System.Runtime.InteropServices.COMException" "The specified directory service attribute or value does not exist.

I have no clue what the issue is here. Can someone help me out? We are running Skype for Business server 2015 CU11.

Skype for Business
Skype for Business
A Microsoft communications service that provides communications capabilities across presence, instant messaging, audio/video calling, and an online meeting experience that includes audio, video, and web conferencing.
614 questions
0 comments No comments
{count} votes

3 answers

Sort by: Most helpful
  1. Sharon Zhao-MSFT 25,081 Reputation points Microsoft Vendor
    2021-03-15T02:52:12.267+00:00

    @Mark Bolten ,

    Do you mean that you are trying to renew the certificates in Skype for Business server 2015?

    Do you check if the information is correct in Certificate Request page?
    77566-image.png

    If the OAuthTokenIssuer certificate is assigned properly in other servers, you just need to restart the “Skype for Business Server Replica Replicator Agent” service on other servers.


    If the response is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


  2. Sebastian 96 Reputation points
    2021-03-22T13:13:03.577+00:00

    Hi,

    I have a similar error here: https://learn.microsoft.com/en-us/answers/questions/314771/assigning-skype-for-business-2015-outh-cert-fail.html

    @Mark Bolten - Did you manage to assign the Oauth cert?

    I get the same (useless) suggestions in my thread as you do.

    0 comments No comments

  3. Sebastian 96 Reputation points
    2021-03-24T10:29:08.09+00:00

    This is how I solved it, this may help you as well. Just make sure you have a good backup in place, just in case.

    1. Removed the current Oauth Certificate that was about to expire via the GUI.
    2. Deleted all AD objects via ADSI Edit within the domain.local/Program Data/Microsoft/Distributed Keyman/
      This is where all Oauth certificates are stored (including present).
    3. Forced AD sync from DC via cmd: repadmin /syncall /AdeP
    4. At the Front-End server Skype shell: Enable-CsAdForest
      Enable-CsAdDomain

    This will restore the corrupted AD objects.

    1. Went to the GUI to assign my new Oauth certificate (request a new one as well if you didn't do that before).

    New certificate is in place. If you have several Front-Ends - reboot them.