topic Jabber MRA with external Certificates in Unified Communications Infrastructure

Jabber MRA with external Certificates

karen.johnson5801 — Tue, 19 Mar 2019 19:24:44 GMT

expert,

can someone guide me on steps how to apply external ceritificate , such as : Go Daddy certificates to Jabber MRA?

thanks,

Did you get a chance to read

Chris Deren — Tue, 09 May 2017 13:29:44 GMT

Did you get a chance to read this guide:

Cisco Expressway Certificate Creation and Use Deployment Guide (X8.9)

Thanks Chris,

karen.johnson5801 — Thu, 11 May 2017 05:07:35 GMT

Thanks Chris,

I read all the link, is this section " Appendix 2: Certificate Generation using OpenSSL " ?

Is the real implement is really text book following all in Appendix 2 will just work ?

or maybe you have notes from past implementation that you can share here?

thanks,

You can just generate the CSR

Jaime Valencia — Thu, 11 May 2017 14:52:44 GMT

You can just generate the CSR in your expressway and then have it signed by your public CA, there is no real need create the CSR with openssl, unless you want to, then you would need to upload the key and certificate.

Hi Jamie,

karen.johnson5801 — Sat, 13 May 2017 18:10:12 GMT

Hi Jamie,

"then have it signed by your public CA " , means just send to Go Daddy support to sign and they will send us back with file to upload to Exp-E?

what is better public CA beside GoDaddy that you recommend or used before?

thanks,

Might want to do some reading

Jaime Valencia — Sat, 13 May 2017 18:23:48 GMT

Might want to do some reading on CSR and public CA to understand this

https://www.sslshopper.com/what-is-a-csr-certificate-signing-request.html

https://en.wikipedia.org/wiki/Certificate_signing_request

Most Cisco products only allow you to generate a CSR, the private key never leaves the server, and you only upload the signed request.

On a VCS, you can also generate your own private key and CSR, and upload both of them, as in the example from the guide using openssl

If you're going to use MRA for IP Phones, make sure to read the doc on what public CA root certs are uploaded on the devices, as only those will work. If this is only for Jabber, most public CA root certs are already in most devices.

Hi Karen,

Alok Jaiswal — Sun, 14 May 2017 08:38:10 GMT

Hi Karen,

I would probably go for Godaddy certificate, I think they have the best deal i believe.

You can go for a UCC certificate and then include all the FQDN as SAN's in a single certificate.

They have options for 5 SAN or 10 SAN's excluding the CN of the certificate which basically means you can have in total 6 or 11 different FQDN's.

We recommend this to all our customer.

It is also supported by the devices registering over MRA for e.g. 7800 or 8800.

Regards,

Alok

Thanks Jamie,

karen.johnson5801 — Tue, 16 May 2017 20:58:54 GMT

Thanks Jamie,

where I read this ?

If you're going to use MRA for IP Phones, make sure to read the doc on what public CA root certs are uploaded on the devices

Thanks,

See here

Jaime Valencia — Tue, 16 May 2017 21:01:14 GMT

See here

http://www.cisco.com/c/en/us/support/collaboration-endpoints/unified-ip-phone-8800-series/products-technical-reference-list.html

Thanks Jaime,

karen.johnson5801 — Wed, 17 May 2017 22:09:29 GMT

Thanks Jaime,

where do I find this ?

If you're going to use MRA for IP Phones, make sure to read the doc on what public CA root certs are uploaded on the devices

best,

I see thanks

karen.johnson5801 — Wed, 17 May 2017 22:10:14 GMT

I see thanks