CSCvn63274 - Expressway attempting IP instead of FQDN for CUCM causing Certificate Check Failure

[Greg Roberts]

Appear to have just encountered this in X12.6.  Anyone else had this issue in that release?

[eschroederJH]

Had what appeared to be this issue after upgrading from CUCM 11.5.1 SU4 to SU8. Post upgrade, cert validation was failing for UDS, so MRA phones could not authenticate:

2020-12-19T09:28:56.482-05:00 edgeconfigprovisioning: Level="ERROR" Service="UDSManager" Detail="UDS get version request failed" UDS="X.X.X.X" Reason="[<twisted.python.failure.Failure OpenSSL.SSL.Error: [('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')]>]" UTCTime="2020-12-19 14:28:56,482"
2020-12-19T09:28:56.480-05:00 edgeconfigprovisioning: Level="ERROR" Detail="Certificate verify failure" Server="X.X.X.X" Reason="Neither common name nor subject alternate name match" CN="Name.domain.tld" SAN="set(list of server FQDNs])" UTCTime="2020-12-19 14:28:56,480"

We rebooted EXP-C and that cleared the issue. We did not have to do the workaround listed in the bug report.

[Greg Roberts]

Good to know.  We just encountered it again in X12.6.4.  Frustrated by all the "workarounds" in this platform versus bugs being fixed by the BU.

[pgendaszewski]

X12.6.2 with CUCM upgrade from 11.5 to 12.5 - same issue. Cluster restart proposed by TAC "resolved" it.