topic Re: Expired Call manager & unity connection certificates in Collaboration Applications

Expired Call manager & unity connection certificates

Ren Stark — Tue, 11 Jun 2019 12:30:28 GMT

Hello,

There are several expired certificates are exist in the current production call manager and unity connection nodes.

The active certificates are exist but I need to clean up these expired certificates since I keep on getting RTMT alerts for this.

Moreover, I have a plan to migrate this current cucm from physical to virtual server.

Should these expired certificates delete before migration?

Doing migration without deleting the expired certificates will cause any issues?

Can I simply delete the expired certificates? Should I look into any dependency for these certificates?

Please reply with your valuable suggestion

Re: Expired Call manager & unity connection certificates

Mike_Brezicky — Tue, 11 Jun 2019 12:53:06 GMT

If they are expired, did you regenerate new certificates for these services? Which certs are they

Anytime I do an upgrade, or in your case a migration, I always like to do a clean up round. You should make sure all active certs (CUCM, tomcat, TVS, etc.) are all valid and up to date, then you can safely remove the others. I would do this before migrating anything.

Re: Expired Call manager & unity connection certificates

Jaime Valencia — Tue, 11 Jun 2019 14:08:23 GMT

Which certificate?

service certificate?

or x-trust certificates?

Re: Expired Call manager & unity connection certificates

Ren Stark — Tue, 11 Jun 2019 14:27:42 GMT

I have regenerated all the service certs(CUCM, tomcat, TVS, etc.), it's all valid now.

But I do have some x-trust expired certs. I give up to delete the expired certs because I am not sure deleting the expired certs will leads to some issues.

How do I verify the trust cert for each node?

The cluster got 6 nodes (1 pub, 4 sub & 1 TFTP) so each node should have 5 (x-trust) trust certs for other nodes?

Can I simply delete the expired x-trust certificates?

Re: Expired Call manager & unity connection certificates

Vaijanath Sonvane — Tue, 11 Jun 2019 15:21:46 GMT

Hi,

First, identify which certificates are expired or no longer required for your system. CUCM base Certificates cannot be deleted (i.e. CallMananger, IPSEC, Tomcat, CAPF, TVS). but any trust certificate can be deleted.

As per attached document, please follow the section Deleting Expired Trust Certificates. I had similar issue in the past and I received this document from Cisco TAC.

Re: Expired Call manager & unity connection certificates

Ren Stark — Wed, 12 Jun 2019 10:54:11 GMT

Thanks for the details.

Is it mandatory to restart the CUCM services after deleting expired certificates?

Is it mandatory to clean up the expired CUCM certificate before starting the migration process?

Re: Expired Call manager & unity connection certificates

Vaijanath Sonvane — Wed, 12 Jun 2019 12:22:38 GMT

Is it mandatory to restart the CUCM services after deleting expired certificates?
Yes, it is mandatory to restart CUCM services.

Is it mandatory to clean up the expired CUCM certificate before starting the migration process?
It is best practice to clean up the expired CUCM certificates before doing any upgrade or migration.