Solved: CUCM 8.5.1 rejects the SSL 8443 port after SU2 upgrade

rogelioalvez · ‎09-21-2011

Hi everybody:

I upgraded my (formerly working) VMware ESXi-based CUCM to SU2 (8.5.1.12900-7 package) on both the Publisher and the Subscriber.

After this upgrade, the Publisher answers with a TCP RST to my connection attempt when the first web page redirects me to the SSL 8443 port. As far as I understand, this is the typical TCP answer from a machine that is not running a service on the requested tcp port.

¿Has anyone ran into this problem? I would reinstall the entire Publisher from the scratch, but the installation and the upgrade process will take 4 hours...

I would appreciate any hints to debug. It seems to be that the SSL engine is not running on my Publisher, but I do not know how to verify if a related process is running or not.

Regards, Rogelio

Joseph Martini · ‎09-22-2011

You can try and run "utils diagnose test Cisco Tomcat" (I think that's the correct syntax, you might want to double check). Can yo connect from a subscriber to the publisher, go to serviceability on the subscriber and try and view the services on the publisher. If you get a certificate error you likely have a certificate problem for the web service (tomcat). From the command line you can regenerate it using "set cert regen Cisco Tomcat" (again I might be off a little with the syntax). Then restart tomcat "utils service restart Cisco Tomcat" to see if that helps.

View solution in original post

michael-luo · ‎09-21-2011

It sounds like the Tomcat certificate was corrupted. You may try to get the Tomcat logs from CLI. Open a TAC case if you don't know how to do that.

Michael

rogelioalvez · ‎09-22-2011

Thank you Michael!. I will read a little and manage to get the logs before trying with TAC. Best regards, Rogelio

Joseph Martini · ‎09-22-2011

You can try and run "utils diagnose test Cisco Tomcat" (I think that's the correct syntax, you might want to double check). Can yo connect from a subscriber to the publisher, go to serviceability on the subscriber and try and view the services on the publisher. If you get a certificate error you likely have a certificate problem for the web service (tomcat). From the command line you can regenerate it using "set cert regen Cisco Tomcat" (again I might be off a little with the syntax). Then restart tomcat "utils service restart Cisco Tomcat" to see if that helps.

rogelioalvez · ‎09-22-2011

Hi Joe:

Actually, yesterday I tried to restart Tomcat ("utils service restart Cisco Tomcat"), and the process was endlessly trying to restart, so I figured out that the problem was in this process. I did not know how to regenerate the certificate, though. I will give it a shot and let you know.

¿Why should it have failed this way if nothing happened with the Subscriber? In fact, I do not remember any error message upon doing the update. Same update DVD, same virtual machine parameters... I can not understand it.

I will let you know soon!

regards, Rogelio