Creating and installing certificates

The web interface certificate via CSR and the Teams SBC certificates from Let's Encrypt.

Applies to: EasyUC 4.8.7 Last updated: October 2026

Part 1 · Web interface

Web certificate: overview

The web certificate secures HTTPS for the admin interface, the portals and the Manager. Until you activate your own certificate, Traefik uses its own self-signed certificate.

EasyUC generates the private key itself and the key never leaves the cluster. You therefore create a certificate signing request (CSR) in the Manager, have your CA sign it and upload the certificate again.

Web certificate workflow. The private key stays in the cluster.

Setting up the web certificate

Create the CSR

Open the SSL certificate section in the Manager. Enter country, state, city, organisation, common name and e-mail address, plus the SAN entries. EasyUC generates a 4096-bit RSA key.
Have the CSR signed

Submit the CSR to your CA, either an internal PKI or a public CA.
Upload the certificate

Upload the signed certificate in PEM or DER format, together with the CA and intermediate certificates.
Activate

EasyUC checks that the certificate matches the key and sorts the chain. If the chain is incomplete, you get a warning. The certificate then applies to all web routes.

Tip

Add every hostname and IP address under which EasyUC should be reachable as a SAN. EasyUC recognises for each entry whether it is a DNS name or an IP address. Because there is no shared virtual IP, a cluster certificate should also include the names you would switch to after a failure, see Redundancy.

Warning

You cannot import an existing private key or a PFX/PKCS#12 file. The certificate must be issued for the CSR created in EasyUC.

Renewing the web certificate

The Manager shows the remaining validity. We recommend renewing when less than 30 days remain.

There is no automatic renewal for the web certificate. Repeat the steps: create CSR, have it signed, upload, activate.

Part 2 · Teams SBC

Teams SBC certificates: overview

For Direct Routing, every Teams tenant needs a public certificate for the SBC. EasyUC obtains it from Let's Encrypt using the DNS-01 challenge. Port 80 does not need to be reachable from the internet for this.

The SAN is the tenant's SBC FQDN, for example sbc.example.com. The domain must be verified in the Teams tenant.

The SBC uses TLS 1.2 with mutual TLS against Microsoft's root CAs. The intermediate certificate is part of the chain.

Issuing the SBC certificate

The DNS-01 challenge requires a TXT record in the DNS zone of the SBC FQDN. You create it by hand, or EasyUC does it through Cloudflare.

Manually

EasyUC shows the TXT record _acme-challenge.<fqdn> and its value.
Create the record at your DNS provider.
Confirm in EasyUC. EasyUC checks the record and issues the certificate.

Example TXT record

_acme-challenge.sbc.example.com.  TXT  "<value shown in EasyUC>"

Automatically with Cloudflare

Store a Cloudflare API token. EasyUC then creates the TXT record itself and removes it afterwards.

This requires outbound TCP 443 from EasyUC to api.cloudflare.com.

Renewal and reload

EasyUC checks daily at 03:30 whether a renewal is due.
With Cloudflare, EasyUC renews the certificate automatically once 30 days or less of validity remain.
Without Cloudflare, the admin interface shows that renewal is due. You then repeat the manual TXT step.
The validity, with expiry date and remaining days, is shown per tenant.

The SBC loads a new certificate automatically. It restarts the tenant's SIP profile as soon as no call is active, at the latest after 30 minutes.