Secure Conference Configuration on CUCM 6.1.4

srgudava · ‎12-10-2009

Secure Conference Overview

The Secure Conferencing feature provides authentication and encryption to secure a conference. A conference is secured when all participating devices have encrypted signaling and media. The secure conference feature supports SRTP encryption over a secure TLS or IPSec connection. The system provides a security icon for the overall security status of the conference, which is determined by the lowest security level of the participating devices. For example, a secure conference that includes two encrypted connections and one authenticated connection has a conference security status of authenticated.

Secure Conference Icons

Cisco Unified IP Phones display a conference security icon for the security level of the entire conference. These icons match the status icons for a secure two-party call, as described in the user documentation for your phone.

For ad hoc and Meet-Me secure conferences, the security icon for the conference displays next to the conference softkey in the phone window for conference participants. The icon that displays depends on the security level of the conference bridge and all participants:

•A lock icon displays if the conference bridge is secure and all participants in the conference are encrypted.

•A shield icon displays if the conference bridge is secure and all participants in the conference are authenticated.

•When the conference bridge or any participant in the conference is non-secure, the call state icon (active, hold, and so on) displays, or, on some older phone models, no icon displays.

Generating the Self-Signed Certificate on the Router

Step 1: You need to generate the RSA KEY for the self-signed certificate you are going to Create.

CFBROUTER#conf t

Enter configuration commands, one per line. End with CNTL/Z.

CFBROUTER(config)#crypto key Generate rsa general-keys label CFBROUTER modulus 1024

The name for the keys will be: CFBROUTER

% The key modulus size is 1024 bits

% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

Step 2: Create the trust-point for the router self-signed certificate

CFBROUTER(config)#crypto pki trustpoint CFBROUTER

Step 3: Confgiure enrollment configuration

CFBROUTER(ca-trustpoint)#enrollment selfsigned

Step 4: Associate the RSA KEY pair you have generated to the trust point

CFBROUTER(ca-trustpoint)#rsakeypair CFBROUTER

Step 5: (Optional) If you do not want the domain name in the certificate

CFBROUTER(ca-trustpoint)#fqdn none

Step 6: (Optional) If you do not want revocation-check

CFBROUTER(ca-trustpoint)#revocation-check none

Step 7:(Optional) If you want subject-name

CFBROUTER(ca-trustpoint)#subject-name CN=CFBROUTER

Step 8: We need to enroll the certificate

CFBROUTER(config)#crypto pki enroll CFBROUTER

% Include the router serial number in the subject name? [yes/no]: no

% Include an IP address in the subject name? [no]: no

Generate Self-signed Router Certificate? [yes/no]: yes

Router Self-signed Certificate successfully created

Step 9: Now copy the self-signed certificate to the txt file. Select the text starting with '-----BEGIN CERTIFICATE-----' to '-----END CERTIFICATE-----' and paste it into a text editor. Save the file as the CFBROUTER.pem format which call manager uses.

CFBROUTER(config)#crypto pki export CFBROUTER pem terminal

% Self-signed CA certificate:

-----BEGIN CERTIFICATE-----

MIICWTCCAcKgAwIBAgIBATANBgkqhkiG9w0BAQQFADA4MTYwEgYDVQQFEwtGVFgx

MTM5QTAyMDAgBgkqhkiG9w0BCQIWE0NGQlJPVVRFUi5jaXNjby5jb20wHhcNMDkx

MjA5MTUxMzEzWhcNMjAwMTAxMDAwMDAwWjA4MTYwEgYDVQQFEwtGVFgxMTM5QTAy

MDAgBgkqhkiG9w0BCQIWE0NGQlJPVVRFUi5jaXNjby5jb20wgZ8wDQYJKoZIhvcN

AQEBBQADgY0AMIGJAoGBAL7WFkgDqHGWtVIXP3VsVQDRAzxMODWjrxE7DlDM9l8C

sYZB6W/iKqGoU8b3QMDJhOky8gRreRduZk5EeHPvanPdf4F7kJ+ylNQXkUU1ouUd

rpFvOG0WvpKMkzZgRSY9ml2yJyO96pu9Tppnnr7ummPslmByBevwxaZdW8ftMJMd

AgMBAAGjczBxMA8GA1UdEwEB/wQFMAMBAf8wHgYDVR0RBBcwFYITQ0ZCUk9VVEVS

LmNpc2NvLmNvbTAfBgNVHSMEGDAWgBQvGViElFhUXoaWKBFd6SxD62cLBTAdBgNV

HQ4EFgQULxlYhJRYVF6GligRXeksQ+tnCwUwDQYJKoZIhvcNAQEEBQADgYEACtFs

PSuOTOlb27Nlg6LFoi+5TeGj0bydyBi7d4rV5/5j2OGHWVI/bwSTzfPnI7Oy4Xdx

C9EShDY7rFyt3V5wbodm91yA2DMM7rbJTJrBnFwsgtI03GfIDAkw7H4ULO9lvBQV

+A2/fqJZbtD9xyq0hRWqX+mDnDmRGrMz/X1mUgA=

-----END CERTIFICATE-----

% General Purpose Certificate: