So,
First, I would like to say that this is my first time attempting to use Security-Profiles. I am interested in implementing them to use with Collab-Edge (MRA).
Currently running (CUCM)10.5.2.12901-1
Currently configured for Mixed Mode
I have created Call-Manager/Call-Manager Trust, Tomcat/Tomcat-trust, and am currently using the 'self-signed' CAPF/CAPF-trust, and have sense reissued CTL files.
I have created Security profiles using the collab-edge FQDN naming scheme, and am currently attempting to test with the following two profiles for CSF and TCT devices (BOT devices later...)
CSF Phone Security Profile config:
*************
Name: CSF.secure-phone.domain.com
Description: CSF Secure phone profile
Device Security mode: Encrypted
Transport type: TLS
TFTP Encrypted config: YES
Authentication mode: By Existing Certificate (Precedence to LSC)
Key Size (Bits): 2048
SIP Phone Port: 5061
TCT Phone Security Profile Config:
********************
Name: TCT.secure-phone.domain.com
Description: TCT (IPHONE) Phone Security Profile Encrypted (TLS)
Nonce Validity Time: 600
Device Security Mode: Encrypted
Transport Type: TLS]
ENABLE Digest Authentication: NO
TFTP Encrypted Config: YES
Exclude Digest Credentials in Configuration File: NO
Authentication Mode: By Existing Certificate (precidence to LSC)
Key Size: 2048
SIP Phone Port: 5061
=======================================================
From the CSF device:
**********************
Certification Authority Proxy Function (CAPF) Information...
+When attempting to Install/Upgrade *Certificate Operation*:
Authentication Mode: By Existing Certificate (precedence to LSC)
Key Size: 2048
Result: "Certificate Operation Status: Upgrade Failed: Invalid Credentials"
I was going perform the following steps after hours:
+Create new CSR
+Sign new CAPF with Internal CA
+Sign new CAPF-TRUST with Internal CA
+Reissue CTL
+Restart Servers (or CUCM/TFTP Services) *Sometimes I just prefer restarting Servers...
Can any one help shed some light on what I'm missing here (why phones won't take the CAPF certificate Operation?
Also, What's the deal with the 'operation completes by'?... is there any way to push the config immediately?
Any Help is welcomed!
Thanks,
-Steve
[edit: 'CUCM version clarification']
