CUCM 8.6 use the certificate generated by external C.A.

[wilsonsant]

Hi Guys,

My Customer have the CUCM 8.6 and is with follow doubt: Is possible to use certificate generated by the external C.A. ? If yes, are there any documentation explain for this?

Thanks,

Wilson

[Ryan Huff]

Hello Wilson,

If you are asking if Cisco Unified Communications Manager 8.6 can use an SSL identity certificate that is signed by a public certificate authority, the answer is yes. The certificate would be uploaded in the Certificate Management section of Communications Manager's Operating System administration.

You need to generate the CSR from Communications Manager first, then use that to upload to your CA, which then the CA will generate the certificate.

Some items to note are;

• You have to upload the full certificate chain (root CA -> intermediary CA -> Server IDENT).
• You will want a certificate for each node in the cluster
• After you install/upload the certificate in the node, you need to restart the Cisco Tomcat Service via the CLI (utils service restart Cisco Tomcat)

The Support Forums Document should help:

https://supportforums.cisco.com/document/30501/cucm-uploading-ccmadmin-web-gui-certificates

Here is the Cisco Security Documentation for Unified Communications Manager 8.6 that outlines, in great detail, all the steps required:

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/cucos/8_6_1/cucos/osg_861_cm/iptpch6.html

Thanks,

Ryan

(: ... Please rate helpful posts ... :)

[wilsonsant]

Hi Ryan and Jaime,

This Customer is a public agency and will use the owner C.A.

Thank You,

Wilson

[Jaime Valencia]

Then, ideally, all you need to worry is to generate the CSR and then upload the certs they will give you back, the rest of it, should be handled by their network admins.

[Jaime Valencia · Accepted solution]

https://supportforums.cisco.com/video/12675036/how-sign-certificates-microsoft-ca

Assuming you're going to be using a public CA, the part you won't be doing, is signing them with your CA.

[Ryan Huff · Accepted solution]

Good thought Jamie!

My original reply does not account for the possibility that the OP would be using a non-public CA. Typically, in my experience, folks reference that as "internal", so when the OP referenced "external", it was a logical jump to translate that to "Public". I appreciate you adding in the missing info to this thread!

Thanks,

Ryan