CUCM 8.6.2 ITL file problem

[josef.berkley]

On a new cluster (2 nodes), when I do a show itl on both servers, I get the error:

Length of ITL file: 0
The ITL File was last modified on Tue Apr 12 12:36:59 EST 2016

Parse ITL File
----------------

Invalid ITL file. Error skipping past version.
Error parsing the ITL File.

I've tried regenerating CUCM pem, TVS pem and tomcat pem then restarted TVS and TFTP services.

Did this on both servers.

There was no change after this.

Of course the phones aren't getting the ITL file but they do get the CTL file.

This is a new/test cluster so there isn't much I'm not willing to do to fix it, but I'm not sure if I can fix short of completely reinstalling the cluster.

Any help is appreciated.

[Jaime Valencia]

By any chance did you not set the prepare cluster for rollback parameter to true??

[josef.berkley]

I did not set that parameter to true, but I'm not sure that it is needed in my case. The cluster was installed as 8.6.2 and we haven't upgraded/downgraded the cluster at all. We really just installed it and added a few devices.I wanted to encrypt the phones and realized that the phones were registering but not getting an ITL file. When I did the Show itl on the CUCM servers, I saw the error. I think at some point the itl file was OK because a few of the initial phones have an ITL in the trust settings, but if I factory reset those phones, they'll register again, but not get an ITL.

[Ayodeji Okanlawon]

Josef,

I found a similar thread that said regenerating only cucm.pem cert did resolve similar issue

https://supportforums.cisco.com/discussion/12868821/safe-regenerate-tvspem-no-trusted-itl

[josef.berkley]

I did see that thread and regenerated the CUCM.pem cert then restarted the TFTP service but there was no change.

After that, I saw another case where it was advised to regenerate the CUCM,TVS cert so I tried that, but still no change.

Thanks.

[Ayodeji Okanlawon]

Josef,

In that case you might want to open a TAC case. Please keep us updated on the resolution

[josef.berkley]

Ayodeji,

We are waiting to resolve a issue with our support contract. Hopefully it is done soon. I wanted to see if anyone had suggestions before then.

Thanks again.

Joe

[Manish Gogna]

One thing that you need to check is that the key size for cert should be less than 4096

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCup54818/?reffering_site=dumpcr

Manish

[josef.berkley]

Just to close this out and in case it ends up helping anyone else...

The problem was resolved after I used a different version of call manager.

The problem was on CUCM8.6.2.25900-8

The issue is not present when we installed CUCM8.6.2.24900-17

I was setting up a test bed and we downloaded a slightly later ova version than what is running on the production system where everything worked properly. For some reason, the newer version did not work with FIPS like the earlier version.

Thanks for anyone that tried to help.