CUCM 12.5 regenerate expired certificates

[Horacio Gutierrez]

Hello,

We have call manager version 12.5 and I need to regenerate some self-signed certificates that expired, however I dont see the button when I open the certificate to regenerate certificate.  How do regenerate expired certificates in call manager 12.5.  Also how can I tell which certificates expired are not be using anymore?

Thanks, 

[Ratheesh Kumar]

Hi there

Only service certificates (certificate stores that are not labeled with "-trust") can be regenerated. Certificates in the trust stores (certificate stores that are labeled with "-trust") need to be deleted, as they cannot be regenerated.

Attached the guide and hope that helps. 

https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/214231-certificate-regeneration-process-for-cis.html

Hope this Helps

Cheers
Rath!

***Please rate helpful posts and if applicable mark "Accept as a Solution"***

[Horacio Gutierrez]

How can I know which certificates are not be used by my call manager anymore before I delete those certificates?

[Nithin Eluvathingal]

if expired Certificates in the trust stores (certificate stores that are labeled with "-trust") need to be deleted, as they cannot be regenerated.

GO through below document.

https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200199-CUCM-Certificate-Regeneration-Renewal-Pr.html

[Nithin Eluvathingal]

You can refer the below Cisco UC Certificates Renewal Guide made by our community Memeber.

https://community.cisco.com/t5/collaboration-voice-and-video/cisco-uc-certificates-renewal-guide/ta-p/4077131

[TomMar1]

Here is the most extensive Certificate document.  https://community.cisco.com/t5/collaboration-voice-and-video/cisco-uc-certificates-renewal-guide/ta-p/4077131  Make sure you read it thoroughly, if you try to generate some certs simultaneously and skip some of the services restarts you may have an unrecoverable situation.  If you do not see a regenerate certificate button either the Cert is externally (CA) signed or is on a subscriber node, not necessarily the publisher.