UCCX Upgrade to 11.5(1)SU1 and Tomcat ECDSA

[LibinBenedict]

Hi,

We are planning to upgrade our UCCX from 10.6(1)SU2 to 11.5(1)SU1. I have read in the documentation that starting 11.5, tomcat service is preconfigured with RSA and ECDSA certificates. We are using internal CA-signed certificates. 

There is bug reported for the version 11.5(1) CSCvb46250 and we can apply a cop if we do not want to present the ECDSA certificate to the agents. And this bug is fixed for the version 11.5(1)SU1. Does it mean that I do not need to sign the tomcat-ECDSA and the agents will not be prompted to accept the ECDSA certificate? Is there any problem if we do not want to sign the tomcat-ECDSA?

Regards,

Libin Benedict

[Anthony Holloway]

What I have done, is just sign the Tomcat RSA one first, then apply the COP to stop UCCX from handing out the ECDSA cert all together. If I'm not mistaken, this effectively disables the ECDSA cert, and uses 100% RSA based certs. Kind of like a "give me the old way back."

[LibinBenedict]

Hi Anthony,

Thanks for the response.

But the COP is applicable for 11.5(1) and not for the SU1. I would like to know how I can skip the signing of tomcat-ECDSA.

The current tomcat certificates in 10.6 version are signed and I hope they will be carried forward during the upgrade.

Regards,

Libin Benedict

Libin Benedict

[Flo.Matalis]

Hi, I tried to find documentation for UCCX 12.5, but cannot seem to find any.

Is this still applicable to fresh installed UCCX 12.5? Do we still have to apply COP or the RSA certificate is enough?

Thanks!

[BradMarkel93582]

UCCX 12.5 does not use ECDSA certificates, so says this configuration guide.  Systems I work with have a self-signed ECDSA cert and a CA signed RSA cert.

Check out:

Configure UCCX Solution Certificate Management

https://www.cisco.com/c/en/us/support/docs/customer-collaboration/unified-contact-center-express/118855-configure-uccx-00.html

"Starting from 11.6, use of ECDSA certificates has been removed from the UCCX solution completely. This includes UCCX, SM/CCP, CUIC and Finesse."

[ntteducollab]

It really seems that UCCX 12.5 doesn't use ECDSA certificates, but I have seen cases where, even if CCX doesn't use an ECDS, you need to regenerate it after an upgrade (self-signed  ECDS cert is sufficient). eg:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd96014