cisco ip phone not register in secure mode .

[iptsupport]

Hello everyone,

I'm having an issue with a new cisco ip phone. It´s showing the "cisco ip phone registration in progress" error message. 
The device(7911,7961)  work secure mode .
The certificate in OS administrator is valid.
if I change the configuration on device to non secure and after change configuration to secure and choose install certificate ,The device register .

how to fix the issue that new phones will  register  that I Perform copy from antoher device without operation that I perform?( non secure ,install certificate  etc )

[Sadav Ansari]

Is other phone working on secure mode ?

Focusing on why the phones won’t register first: is the LSC of the phone itself expired? That would definitely cause it and explain why older phones models - which presumably got an LSC years earlier - would have failed first.

Focusing on CPAF next, you will need to regenerate that certificate, validate the new one is added to CAPF-Trust and CallManager-trust, re-run the CTL client to add the new cert to your CTL, restart services, and finally reset phones to pick up the new CTL. After that is done you can renew the LSC on phones and they should register again.

As for TVS, those certificates are included in the ITL but are not used to sign it. You should be able to regenerate the TVS certificate, restart services to get the ITL file updated, and then reset phones to pick up the new ITL.

Read the security guide and this document before proceeding though:
https://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-communications-manager-callmanager/116232-technote-sbd-00.html

Pls rate if its “Helpful”. If this answered your question pls click “Accept as Solution”.

[iptsupport]

Hey Sadav Ansari,

first i want to thank you for your explain.

about your answer i think you don't understand me.

the problem is that after i do "Copy" to device that i install to him Valid LSC he cant register, only if i install  in the new phone the LSC it work.

i cant understand why when i do copy to phone that i install to him LSC the new phone not work until i install him to the LSC.

[Roger Kallberg]

The phone has to have gone through the process of deployment of the LCS for it to work in secure mode. It’s not very clear in your posts if you have done that or not. Can you please outline, step by step, what exactly that you do?

[iptsupport]

ok .
I have Phone A that was in unregister(this is new phone, its phone that was  not connect to system before long time ago) , i install in phone A the LSC and after that the phone was register and work.
after this I want to configuer Phone B so i do copy to phone A and put the new mac address of the phone.
after that the phone no register only after i install in the new phone the LSC it work.
my question is why the phone is not install the LSC Auto

[Roger Kallberg]

Because it’s a per phone process that you need to do for each phone. It does not install it automatically just because you copy a present phone and change the MAC address.

[Nithin Eluvathingal]

You mean the phone register only after installing the LCS and with MIC its not register  ?  is that correct ?

you mentioned its a new phones, are they brand new phones, what's your CUCM version. 

[iptsupport]

yes.
this is new phone,
its phone that was  not connect to system before long time ago.

my cucm version is 11.5.1