topic Re: Expressway E for MRA with ACME/LetsEncrypt in Collaboration Applications

Expressway E for MRA with ACME/LetsEncrypt

Clifford McGlamry — Mon, 19 Sep 2022 21:02:23 GMT

According to the Expressway Certificate usage guide, the Expressway E on an MRA setup needs:

1. Its own FQDN

2. The name of the registration domain

In order to get this working with LetsEncrypt, I have to have DNS a records for expressway.mydomain.com and mydomain.com pointing to the IP address of the Expressway E.

How the heck are you going to pull this off? That registration domain is also the company root domain, and it's pointed elsewhere. This cannot be a unique problem. How do you work around it? Or will it work with just the FQDN???

Re: Expressway E for MRA with ACME/LetsEncrypt

b.winter — Tue, 20 Sep 2022 07:45:05 GMT

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X14-0-2/cert_creation_use/exwy_b_certificate-creation-and-use-deployment-guide-x1402/exwy_b_certificate-creation-use-deployment-guide_chapter_0100.html

Re: Expressway E for MRA with ACME/LetsEncrypt

Clifford McGlamry — Tue, 20 Sep 2022 23:52:34 GMT

That did it. I don't recall seeing that caveat in the 12.7 guides.

Re: Expressway E for MRA with ACME/LetsEncrypt

b.winter — Wed, 21 Sep 2022 06:47:01 GMT

Glad to hear that it worked.

"I don't recall seeing that caveat in the 12.7 guides." - Yes/No. That kind of info was already there since ages. But I didn't really had an impact anywhere else than on the certificate's SAN entries.
You could choose to include the registration domain either as it is (e.g. "cisco.com") or with the prefix "collab-edge" (e.g. "collab-edge.cisco.com"). Depending on, if it is allowed by the CA to include the public domain.
But there never had to be a DNS record for that in regards to Expressway.