CUCM CAP-RTP-001 and CAP-RTP-002

[extremum]

Hello ,

These tow certs CAP-RTP-001 and CAP-RTP-002 are installed the cucm as callmanager-trust and capf-trust , they will be expired in 2023 . How can we get new / valid certs .

Thanks.

[BenBen]

I am working for a solution/suggestion/recommendation for this as well. There are several certificate renewal/regeneration documents floating around in addition to the security management guide. Not too much was said about CAP-RTP-001 and CAP-RTP-002 which are expiring on Feb 6, 2023!

Seriously we need to know what these two certificates are/were used for, and only Cisco can answer that question. I downloaded some MIC certificate from the ip phones, they were signed by "Cisco Manufacturing CA" with serial number "6a6967b3000000000003" which has an expiration date of  05/14/2029 (whew).

Will be much appreciated if anybody can share the experience to us.

Much thanks.

-Ben

[Roger Kallberg]

These certificates are used if your system is running in Mixed mode for device secure registration.

[veronique8789]

We are running the Mixed Mode fonction and we are using CAPF with NAC.

We did renew the CAPF certificate last year.

Are those needed to for the mixed mode  ?

CAP-RTP-001 & CAP-RTP-001 (callmanager-trust/capf-trust) ?

[Roger Kallberg]

These specific once are used to validate the MIC on the devices when you run in secure mode. As these eventually will expire Cisco provides new certificates that is used for this in updates of CM. That is yet another reason for why it is advisable to keep the system(s) up to date.

[veronique8789]

we are running version 12.5 and everytime we did cucm upgrade, I dont think those certificate change or got updated. Since we are running in mixed mode and those certificate are not renewable, what is the solution for us ?

[Roger Kallberg]

An upgrade typically adds new/other certificates that is used to validate the MIC. If you look at the certificates that you have in your CM you'd see a list of certs used for validation of the MIC on the devices. These once that are expiring can be removed.

[veronique8789]

thank you for your answer. If I look the list of certificate, I see those that are expiring couple years later and they have the same description : 

- Cisco_Root_CA_2048
- ACT2_SUDI_CA
- Cisco_Manufacturing_CA_SHA2
- Cisco_Manufacturing_CA
- Cisco_Root_CA_M2

So I guess those were previously installed through an Upgrade and they will be used instead of the one expiring ?

[Roger Kallberg]

That is correct and is my understanding as well. For additional information on this you can have a look at this post that discussed more or less the same thing.

https://community.cisco.com/t5/unified-communications-infrastructure/cucm-capf-certificate-question/td-p/4749655

[veronique8789]

great

thank you 

[AbdulVaseemMohammed5593]

Hi Roger, I have deleted CAP-RTP-001 certificate from Callmanager-Trust but could not delete it from CAPF-Trust store. Received HTTP Status 404 Error.

[AbdulVaseemMohammed5593]

I'm able to delete it from CAPF-Trust store as well. Earlier, I have stopped the Certificate Change Notification service as best practice before deleting any certificate. Not sure if that caused the issue. Later on we started back that service and deleted it from CAPF store. Thank you!

[tgguzman]

Im am running mixed mode and have a secure cluster. So your saying that I will need to renew this certificate even if I have LSC extended to all the phones?

[Roger Kallberg]

No that is not what I wrote. The certificates that are used for verification of MIC on the devices are updated by Cisco. The certificates that is expiring are not used as they are replaced by other certificates. These gets installed during upgrades of the system.

[RAustin70]

Thank you for your knowledge Roger, it is much appreciated.

My system right now (12.5) is in non-secure mode, so I can delete these things, but in the near future I will have to jump up to mixed mode and activate all this joy.  Are you aware of how cisco is planning to provide new Certificates for 12.5 or 14?  would it be through an ES or SU?

Rob

[Meraj Ali]

You can refer to this post that has the same topic covered in some detail - https://community.cisco.com/t5/unified-communications-infrastructure/cucm-capf-certificate-question/td-p/4749655

If you have a large environment or difficulties understanding their dependency, I would advise reaching out to TAC.