How to sign certificates with a Microsoft CA

[Jaime Valencia]

Through this video, I'll show you how to configure a Microsoft CA, running over a Windows 2012 Std server, to sign the tomcat certificate from CUCM.

I will assume you have already configured and installed the CA, if you need assistance on that topic, there's plenty of material on the web, you can use this as a reference:

https://technet.microsoft.com/en-us/library/cc731183.aspx

You might also want to change the validity period for your CA, if you're going to do this, I strongly recommend you do it right after you install your CA

https://support.microsoft.com/en-us/kb/254632

The keys mentioned in the above are still valid in newer releases.

Also, very important, bear in mind SHA1 has been deprecated, when you configure the CA, you should choose other option, I'm using SHA256 in my lab.

If you're going to be doing multi-server certificates and have public CA sign them, review the bugs mentioned in the Cert FAQ below, specially if you're on 10.5(x), as of November of this year, new changes in the procedure require all domains to be signed to be public domains, and the multi-server option will cause an error.

Any questions, comment, etc. you can reach me at javalenc@cisco.com

[Jaime Valencia]

I have not looked into certificate transparency, I would need to do some research before I could provide an answer, but that would take me some time as right now I have plenty other things that require my attention.

[reza aminzaboli]

Hi Jamie, for cucm tomcat service you used webtemplate as a base in the MS CA. how about for the callmanager service or other services requring certs?

[Jaime Valencia]

As I explain here

http://docwiki.cisco.com/wiki/Certificates_FAQ

You usually want to look at the original certs that come self-signed, and try to adjust the template as close as possible to them.

[reza aminzaboli]

I appreciate it but my question was do we still use the web template as a base?

[Jaime Valencia]

Yes, you can use it. You can use any template you want and modify as required.

[Muzaffar Ahtesham]

Excellent article!

Thank you Jaime

Got a question about CSR, when generating CSR I noticed the Certificate in use has CN as IP address of the server. While Common Name field of CSR by default picks up FQDN of the server.

Does it have any impact if I generate CSR with FQDN instead of IP address in the Common Name field of CSR?

[johnk]

Nice job Jaime!  This makes this much easier for me!

[fachroky1]

hi Jaime,

I have the same problem like “audvintech” in your command, but i clearly dont understand the language.

So do i need the CA certificate that issued by microsoft CA instead of self signed certificate by CUCM ?

thanks, 

Fachroky