CUCM 10.5 and CSR (security cert)

[vipersl65]

When I click on Callamanger and select Generate CRS, there is a field in the popup called Domain name which shows the companyname.com.

In 10.5, I was told that this is required.  Anyone cares to explain in more details?

Also, I noticed that there is callmanager and there is also tomcat from Certificate Management.  I select callmanager and use that to generate CSR and I submit it to a 3rd party CA. If I repeat the same process but this time selecting tomcat, the 3rd party CA will complain of a duplicate.  Ideas?  or callmanager alone is good?

My goal is to encrypt calls

[George Thomas]

DId you follow the guide below?

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/10_0_1/secugd/CUCM_BK_C68276B4_00_cucm-security-guide-100/CUCM_BK_C68276B4_00_cucm-security-guide-100_chapter_0100.html

[vipersl65]

George,

Which parts as I am not using client token as this is 10.5?

[George Thomas]

In your case, the CLI part. However i would read this guide fully to understand mixed mode cluster security.

[vipersl65]

Here's the highlevel overview of what I did

1) CUCM is in non-scure mode

2) Download callmanager CSR and sent to Verisign

3)Received callmanager.CER from verisign

4)Uploaded it by selecting callmanager-trust.   If I select callmanager, I get an error about store

5)rebooted the server

6)enabled mixed mode via CLI

7)Rebooted the server

This is the time I tried to go to the IE certifcation path and didnt get that same tree you have

[vipersl65]

this is the only part in that doc that i followed

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/10_0_1/secugd/CUCM_BK_C68276B4_00_cucm-security-guide-100/CUCM_BK_C68276B4_00_cucm-security-guide-100_chapter_0100.html#CUCM_TP_C836716D_00

[vipersl65]

Do I need to download this root and intermediate cert from the OS admin of CUCM or that is from the pic you sent wherein I do it in the IE browser connected to my CUCM?

[George Thomas · Accepted solution]

Can you send me the cert somehow? Fileshare or PM me via the community?

[vipersl65]

How do I PM you?  Been trying to do that

[islam.kamal]

Hello

you have to generate intermediate certificate from Root certificate. After this you have to upload  CA to tomcat-trust , the upload the certificate .cer to trust tomcat after you uploaded it CUCM changes the name of the file to <SUBJECT CN>.pem. . Kindly check the below links:-

http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-communications-manager-version-60/112108-sslcert-cucm-00.html

https://supportforums.cisco.com/document/30501/cucm-uploading-ccmadmin-web-gui-certificates

https://supportforums.cisco.com/document/91906/high-level-view-certificates-cucm

Thanks

please rate all useful information