Failed TLS connection between unified communications peers generates an Schannel warning

The following methods work around the issue that is described in the "Symptoms" section.

Method 1: Remove some trusted root certificates

Warning You should use caution when you remove Trusted Root Authority certificates. The removal of third-party Trusted Root Authority certificates could break secure client access to applications that are hosted on the Windows-based server.

If some trusted root certificates are not used in your environment, you should remove them from the server that is hosting the UC application. To do this, follow these steps:

Windows Server 2008 R2, Windows Server 2008, and Windows Server 2003

1. Click Start, click Run, type mmc, and then click OK.
2. On the File menu, click Add/Remove Snap-in, and then click Add.
3. In the Add Standalone Snap-in dialog box, click Certificates, and then click Add.
4. Click Computer account, click Next, and then click Finish.
5. Click Close, and then click OK.
6. Under Console Root in the Microsoft Management Console (MMC) snap-in, expand Certificates (Local Computer), expand Trusted Root Certification Authorities, and then click Certificates.
7. Remove trusted root certificates that you do not have to have. To do this, right-click a certificate, click Delete, and then click Yes to confirm that you want to remove the certificate.

InformationTo learn more about how to automate the removal and installation of the third-party Trusted Root Authority certificates that are installed on Windows Server operating systems, click the following article number to view the article in the Microsoft Knowledge Base:


Information There are some root certificates that are required by Windows. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Method 2: Configure Group Policy to ignore the list of trusted certification authorities on the computer that hosts the UC client

If the server that hosts the UC application is a member of a domain, you can create a policy that causes the server to ignore the list of trusted certification authorities on the computer that hosts the UC client. When you apply this policy, affected servers and clients trust only certificates that are in the Enterprise Root Certification Authorities store. Therefore, you do not have to change individual computers.

Windows Server 2008 R2 or Windows Server 2008

Use Policy to Distribute Certificates

Windows Server 2003

Add a trusted root certification authority to a Group Policy object


Note There are some root certificates that are required by Windows. You must add these certificates to the policy that you created. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Method 3: Configure Schannel to no longer send the list of trusted root certification authorities during the TLS/SSL handshake process

You can follow these steps in Windows Server 2008 R2, Windows Server 2008, and Windows Server 2003.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require you to reinstall the operating system. Microsoft cannot guarantee that these problems can be resolved. Modify the registry at your own risk.

On the server that is running the UC application on which you experience this problem, set the following registry entry to false:



By default, this entry is not listed in the registry. By default, this value is 1 (True). This registry entry controls the flag that controls whether the server sends a list of trusted certification authorities to the client. When you set this registry entry to False, the server does not send a list of trusted certification authorities to the client. This behavior may affect how the client responds to a request for a certificate. For example, if Internet Explorer receives a request for client authentication, Internet Explorer displays only the client certificates that appear in the chain of one of the certification authorities that are in the list from the server. However, if the server does not send a list of trusted certification authorities, Internet Explorer displays all the client certificates that are installed on the client computer.

To set this registry entry, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL
3. On the Edit menu, point to New, and then click DWORD Value.
4. Type SendTrustedIssuerList, and then press Enter to name the registry entry.
5. Right-click SendTrustedIssuerList, and then click Modify.
6. In the Value data box, type 0 if that value is not already displayed, and then click OK.
7. Exit Registry Editor.

Note There are some root certificates that are required by Windows. You must add these certificates to the policy that you created. For more information, click the following article number to view the article in the Microsoft Knowledge Base: