7800 phone on MRA won't register

[Clifford McGlamry]

Customer has an infrastructer with 12.5 CUCM and is running Expressways for MRA.  

Recently while looking at a problem, it was noticed that multiple SSL certs on the CUCM were expired, including CAPF, Callmanager ECDSA, Callmanager RSA on sub only, and TVS.

Went through the steps to regenerate CAPF, restarted the services (they are in mixed mode, and the CAPF service is not activated so it was the TVS and TFTP services) and rebooted the phones.  10 of the phones register via MRA, and everything worked fine the next day.  

2 days later, we regenerated the Callmanager ECDSA certs on pub and sub, and the Callmanager Sub RSA cert.  Reset CUCM service, CTI Manager Service, TVS, and TFTP, and rebooted phones.  

Internal phones came up just fine.  MRA phones.....they won't register.  Tried clearing the ITL file on one of the phones, and it still won't register.  Reset to factory defaults.....no dice.  Still won't register.  

I'm not sure why this is happening, but I suspect that they will have to get those phones into the office on the internal network to get the back up before sending them back home.  Or.....am I missing something here?  Searched and could not find anyone discussing this particular issue/problem.  

[b.winter]

Have you checked to logs of the Expressways while the phone tries to register?
You can also uploaded the logs to the CSA tool https://cway.cisco.com/csa/ and let it analyze.

[Clifford McGlamry · Accepted solution]

Actually found the problem, and it was one I hadn't seen before.  The expressway E had to SSL certs in the CA list for the CA that signed the Expressway C cert.  One of the CA certs was expired, but had the exact same name as the new cert.  Deleted the expired one and restarted the services, and everything began working.  Really odd, especially with the timing of other work that was being done that was initially assumed to be the cause!