6

Whitelisting all Lync hostnames is cumbersome. Globally deactivating SSL inspection is undesirable.

At a place I work for, they have SSL-inspection enabled on their proxy. All traffic to the Internet has to go via this proxy server.

Most of the time, it is not a problem, except when it comes to Lync. This company has chosen to be federated with everyone.

Now, when we try to establish conferences, whiteboard, desktop sharing with external companies, it usually fails.

When we trace the traffic, we have been able to pinpoint the hostnames used for Lync traffic, and exempted them from SSL inspection.

Now, the problem is that this was just for one company. And we probably need to do this again for another. And another, and another... As each different company has their own Lync infrastructure and hostnames for Lync services.

This gives me the impression that Lync is forcing some companies to turn off SSL inspection globally, as the user requires Lync, and the manual labor required to exempt sites from inspection is too big.

Surely there's a better way?

While this is an open question on how you handle this situation, some solutions are better than others. Official KBs from Lync and proxy vendors say the same: you have to whitelist the Lync hosts. But they ignore that there are pretty many of them out there.

So please, if you have a better solution, post it as an answer below.

Background

And I would like to add the reasons SSL inspection does not work:

  1. Lync does not speak standard SSL
  2. Lync only allow certificates origined from the Lync servers. (Certificate/Public key pinning.) It disregards the trusted CAs installed on the client computers - so the proxy-issued certificate is invalid for Lync.
1

If the facts you mention in the Background section are true - there is no other way of making it work. If a client application looks for specific signature you can't use your proxy.

I think the best way you can handle it is to write a script that identify Lync servers, and add it to the exempt list.

  • I have already made that script :) I found no other way to get around the problem. – Dog eat cat world Apr 3 '16 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.