Where can I find the client root and subordinate certificates that the MPP devices use for SSL/TLS?

[Geovani]

Introduction

All MPP phones have a Cisco signed client certificate, but they might vary depending on firmware and/or hardware version. The quickest way of establishing which client certificate the phone is using, is to enable HTTPS and check what SSL certificate the phone is presenting.

Enable HTTPS

1. Login to http://IP_ADDRESS_PHONE/admin/advanced
2. Navigate to Voice --> System
3. Set “Enable Protocol” to “HTTPS
4. Change the Web Server Port number (on this case we are using the default HTTPS 443 port) – Note: by changing the protocol to HTTPS, the phone will not change to port 443 automatically, you can to change it manually
5. Click on Submit All Changes

Check Client Certificate in Firefox

1. Login to https://IP_ADDRESS_PHONE/admin/advanced
2. Firefox will give you a security warning.
   1. Click on “Advanced” and “Accept the Risk and Continue”
      
      
      
   2.  
3. Click on “Show Site Information"
   
4. Click on “Show Connection Details”
   
5. Click on “More Information”
   
6. Click on “View Certificate”

Check Client Certificate in Chrome

1. Login to https://IP_ADDRESS_PHONE/admin/advanced
2. Chrome will give you a security warning
   1. Click on “Advanced” and “Proceed”
      
      
      
3. Click on “Not secure” followed by “Certificate”
   

All Cisco root and subordinate certificates can be found at the following URL:

https://www.cisco.com/security/pki/

If web access is not available for any reason, use openssl (s_client -connect) to connect to the phone in order to check the issuer of the phone certificate which will be a subordinate certificate which will correspond to an entry on the PKI site, and to also check the issuer of the subordiniate certificate, which will again be another Cisco certificate on the PKI site.

If the issuer of the subordinate certificate does not appear using the s_client command, then again use openssl (x509 -in [cert_name] -text -noout) to analyse the downloaded subordinate certificate in order to find out which root certificate issued the subordinate certificate.  Again, the root certificate will correspond to an entry on the PKI site.