CUCM 11.5 Callmanager-Trust

[Zachary Ballard]

Hello everyone.

I had some Callmanager,TVS ,CAPF & IPSec certificates(self signed) expiring next month so I went ahead and regenerated everything last night.

I followed this document: https://community.cisco.com/t5/ip-telephony-and-phones/regeneration-of-expired-all-certicates-on-communications-manager/td-p/2928284

Everything seemed to work great but I noticed that on my publisher and subscriber, the Callmanager cert is updated but it did not generate new new Callmanager-trust. Is this normal behavior?

The CAPF and IPSec both generated a new -trust certificate.

Thanks!

[Mike_Brezicky · Accepted solution]

The *-trust certs are ones that have been manually uploaded, for example, from another cluster. The cluster should natively trust itself, so you should not need the -trust for itself.

[Roger Kallberg]

On the sub(s) I think you should see the Pub certificate in the trust store. That's anyway what we have for our CA signed Multi-server (SAN) CallManager certificate.