I’ve encountered this one twice now, so I figure it’s worthy of a post.

Scenario:

• Your new Lync deployment looks good
• DhcpUtil.exe –EmulateClient works like a charm, reporting SUCCESS
• You plug a new Common Area phone in and jump through the config settings on screen. It logs in OK
• Choose either :
  • You move it to its new location and plug it in
  • You leave it alone, it sucks a firmware update and automatically reboots
• You expect the phone will login, but instead you get this error:
  “Certificate web service cannot be found. Please contact your support team”. [Wonderful: that’s me!]
  
• BUT: if you now re-key the phone number and PIN, it will login OK.

The fix is a simple one: you have Spanning Tree enabled, and the phone times out its DHCP discovery and initialisation process while the port is still in a listening/learning state. (That’s why if you re-key the number and PIN it will login OK).

The fix is to reconfigure the switch to enable PortFast.

(Reference – and a shout out to Eric for the tipoff).