I have problems with calls to a RGS.

The call hit the RGS, and the user is alerted, but when the user accept the call it's not established, and the user see an error 429.
The log on the Front-End is showing this

TL_VERBOSE(TF_COMPONENT) [0]094C.1D08::09/28/2010-18:20:16.738.0002f135 (SIPStack,`ReferProcessor::InboundState::ProcessClientNonReferDnsCb'::`2'::ConnectHandler::HandleConnectCallback:ReferInbound.cpp(693))( 1986198663 )( 00000000073CC448 ) Enter - Connect callback for non-REFER [8] request 0000000007A4DF90 from client, connectCompleted=0x00000001(true)
TL_VERBOSE(TF_COMPONENT) [0]094C.1D08::09/28/2010-18:20:16.738.0002f136 (SIPStack,ReferProcessor::InboundState::ProcessClientNonReferConnCb:ReferInbound.cpp(866))( 1986198663 )( 0000000008C3DC60 ) Enter
TL_INFO(TF_COMPONENT) [0]094C.1D08::09/28/2010-18:20:16.738.0002f137 (SIPStack,ReferProcessor::InboundState::ProcessClientNonReferConnCb:ReferInbound.cpp(896))( 1986198663 )( 0000000008C3DC60 ) Validate a referrer digest that was signed by [lync.contoso.local]
TL_VERBOSE(TF_COMPONENT) [0]094C.1D08::09/28/2010-18:20:16.738.0002f138 (SIPStack,CSIPMessage::ParseMemberHeader<CSIPMultiEntryHeader>:SIPMessage.cpp(5906))[1986198663]( 0000000007A4DF90 ) Exit - header present and parsed. Returns S_OK
TL_VERBOSE(TF_COMPONENT) [0]094C.1D08::09/28/2010-18:20:16.738.0002f139 (SIPStack,ReferProcessor::BuildReferrerIdentityDigest:ReferProcessor.cpp(507))[1986198663] Exit - digest string is [rgs@contoso.com|coo@contoso.com|lync.contoso.local@contoso.com|Tue, 28 Sep 2010 18:20:15 GMT]
TL_ERROR(TF_COMPONENT) [0]094C.1D08::09/28/2010-18:20:16.739.0002f13a (SIPStack,CryptoSigner::VerifySignedBlob:CryptoSigner.cpp(386))( 0000000003CE9310 ) Exit - CryptVerifyDetachedMessageSignature failed. Returned 0xC3E93C80(SIPPROXY_E_REFERRER_SIGNING_CERT_CHANGED)
TL_VERBOSE(TF_COMPONENT) [0]094C.1D08::09/28/2010-18:20:16.739.0002f13b (SIPStack,RichResult::InternalAppendContext:RichResult.h(478))[1986198663]( 00000000073CC480 ) Context[0] is now set to 00000000073CC4A0 [0xC3E93C80(SIPPROXY_E_REFERRER_SIGNING_CERT_CHANGED)]
TL_WARN(TF_COMPONENT) [0]094C.1D08::09/28/2010-18:20:16.739.0002f13c (SIPStack,ReferProcessor::InboundState::ProcessClientNonReferConnCb:ReferInbound.cpp(932))( 1986198663 )( 0000000008C3DC60 ) Exit - crypto failed to validate identity digest signed by [lync.contoso.local]. Returned 0xC3E93C80(SIPPROXY_E_REFERRER_SIGNING_CERT_CHANGED)
TL_VERBOSE(TF_COMPONENT) [0]094C.1D08::09/28/2010-18:20:16.739.0002f13d (SIPStack,`ReferProcessor::InboundState::ProcessClientNonReferDnsCb'::`2'::ConnectHandler::HandleConnectCallback:ReferInbound.cpp(701))( 1986198663 )( 00000000073CC448 ) Callback owner inbound router with result 0xC3E93C80(SIPPROXY_E_REFERRER_SIGNING_CERT_CHANGED)
TL_VERBOSE(TF_COMPONENT) [0]094C.1D08::09/28/2010-18:20:16.739.0002f13e (SIPStack,`SIPRouterInbReqNonEP::RSA_VerifyReferrer'::`2'::ReferHandler::HandleReferCallback:SIPRouterInbReqNonEP.cpp(293))( 1986198663 )( 0000000008C3F5C0 ) Enter
TL_VERBOSE(TF_COMPONENT) [0]094C.1D08::09/28/2010-18:20:16.739.0002f13f (SIPStack,SIPRouterInbReqNonEP::VerifyReferrerCb:SIPRouterInbReqNonEP.cpp(402))( 1986198663 )( 0000000008C3DC20 ) Enter
TL_VERBOSE(TF_COMPONENT) [0]094C.1D08::09/28/2010-18:20:16.739.0002f140 (SIPStack,CSIPMessage::ParseMemberHeader<CSIPMultiEntryHeader>:SIPMessage.cpp(5906))[1986198663]( 0000000007A4DF90 ) Exit - header present and parsed. Returns S_OK
TL_ERROR(TF_SECURITY) [0]094C.1D08::09/28/2010-18:20:16.739.0002f141 (SIPStack,SIPAdminLog::WriteSecurityEvent:SIPAdminLog.cpp(424))$$begin_record
LogType: security
Text: The identity of the referrer could not be verified with the ms-identity information
Result-Code: 0xc3e93c80 SIPPROXY_E_REFERRER_SIGNING_CERT_CHANGED
Connection-ID: 0x2B7E00
Peer-IP: 172.18.0.221:63905
Peer: 172.18.0.221:63905
SIP-Start-Line: INVITE sip:lync.contoso.local@inceptio.dk;gruu;opaque=srvr:MediationServer:s5L4s-d7WV-ilfcZVj0ccAAA;grid=44d8004ed4c441f4bf450e63c5a1252f SIP/2.0
SIP-Call-ID: 78ad243aff0e4cb793555f1529d35fc2
SIP-CSeq: 1 INVITE
Data: signer="lync.contoso.local"
$$end_record

If the user is call directly, the call connects without any errors.

The setup is an Lync Server 2010 RC Standard Edition, with a Dialogic DMG 2021 gateway

Any ideas?

Found the error

After an restart of all Lync services, everything worked

• Marked as answer by Claus-Ole Olsen - Old Thursday, September 30, 2010 9:28 PM

Found the error

After an restart of all Lync services, everything worked

• Marked as answer by Claus-Ole Olsen - Old Thursday, September 30, 2010 9:28 PM

Found the error

After an restart of all Lync services, everything worked

• Marked as answer by Claus-Ole Olsen - Old Thursday, September 30, 2010 9:28 PM

Found the error

After an restart of all Lync services, everything worked

• Marked as answer by Claus-Ole Olsen - Old Thursday, September 30, 2010 9:28 PM

Yup, If you change the certificate on the front-end server remember to restart the lync services.

Best regard - Espen 

I thank you so much for this reply you put here.  Even though it was 2 years ago, it was still helpful.  I ran into the same issue where I renewed the certificates but **did not restart the lync services** after that.  I did not do so however, intentionally as I did not find any official microsoft documentation at all that indicated that lync services needed to be restarted after changing the front end pool certificate. In addition, Lync server logged a "successful" message in the event log indicating it had properly detected the new certificate being assigned etc.  I'd love to see **specific** documentation regarding the specific reason why all services must be restarted after a certificate renewal.  It seems a little cumbersome to have to bring the systems down just because of a regular certificate maintenance operation; of course, I may simply not know enough about Lync's internal functionality to understand this.  If anyone knows, feel free to post it.  Thx !!

Thank you for the help. Everything working fine after we rebooted all the lync services.

Thanks again,

DS