Configuring Office Web Apps Server communication using HTTPS

     Hi all :

     Office Web Apps Server can communicate with SharePoint 2013, Lync Server 2013, and Exchange Server 2013 by using the HTTPS protocol. In production environments, we strongly recommend that you use HTTPS. In test environments that contain no user data, you can use HTTP for SharePoint 2013 and Exchange Server 2013 and skip the certificate requirement. Lync Server 2013 supports only HTTPS.

Certificates that are used by Office Web Apps Server must meet the following requirements:

  • The certificate must come from a trusted Certificate Authority and include the fully qualified domain name (FQDN) of your Office Web Apps Server farm in the SAN (Subject Alternative Name) field. (If the FQDN is not in the SAN when you try to use the certificate, the browser will either show security warnings or won’t process the response.)

  • The certificate must have an exportable private key. On single-server farms, this option is selected by default when you use the Internet Information Services (IIS) Manager snap-in to import the certificate.

  • The Friendly name field must be unique within the Trusted Root Certificate Authorities store. If you have multiple certificates that share a Friendly Name field, farm creation will fail because the New-OfficeWebAppsFarm cmdlet will not know which of those certificates to use.

  • The FQDN in the SAN field must not begin with an asterisk (*).

  • The certificate properties and extensions do not matter. For example, customers have asked us whether Client Enhanced Key Usage (EKU) extensions or Server EKU extensions are required. Office Web Apps Server requires no particular certificate property or extension.

 

     When you installed Office Web Apps Server, you need to request a valid certificate. Now I will to show how to request a OWA certificate.

     1. Logon to ADCS server, open the Certificate Template Console, right-click Web Server and click Duplicate Template :

     2. Enter a Template name , and select Allow private key to be exported :

      3. Click OK to create it, then issue this template:

     4. Logon to Office Web Apps Server, open the Certsrv website :

      5. Click Request a certificate --- advanced certificate request --- Create and submit a request to this CA --- Advanced Certificate Request page , select just created template and enter a certificate name and a Friendly Name :

         6.Click Submit> , then click Install this certificate on the Certificate Issued page:

       7. Then use New-OfficeWebAppsFarm cmdlet to create the Office Web Apps Server farm by HTTPS:

     Note : The URL that you specify for -InternalURL is the FQDN name of the server that runs Office Web Apps Server. The URL that you specify for –ExternalURLis the FQDN name that can be accessed on the Internet. You must specify the friendly name of the certificate by using the –CertificateName parameter. The –EditingEnabled parameter is optional and enables editing in Office Web Apps when it is used together with SharePoint 2013. The –EditingEnabled parameter is not used by Lync Server 2013 or Exchange Server 2013 because those hosts do not support editing.

      8. Last , access https://server.contoso.com/hosting/discovery to verify that the OWA server farm was created successfully, if Office Web Apps Server works as expected, you should see a Web app Open Platform Interface (WOPI)-discovery XML file in your web browser :

 

 

         Enjoy!

         Justin Gao

         Microsoft (China)