CUCM CAP-RTP-001 and CAP-RTP-002

[extremum]

Hello ,

These tow certs CAP-RTP-001 and CAP-RTP-002 are installed the cucm as callmanager-trust and capf-trust , they will be expired in 2023 . How can we get new / valid certs .

Thanks.

[Jaime Valencia]

The topic of certificate renewal has been discussed many, many times before in threads and there is already existing documentation on the topic, have you reviewed any of those before posting?

[Pointbreak]

If you do not want to answer , keep quiet. Do not act like GOD

[MrSBN]

Kaboom!

[PatrickDevaney5132]

Not helpful

[Roger Kallberg]

Are you using the CAPF service, ie are your system ion Mixed-Mode? If the answer is No then you can simply disregard these. If you like to anyway renew them, to not have expired certificates in your system please have a look at this document that I wrote a few years ago. Cisco UC Certificates Renewal Guide 

[extremum]

Hello ,

CAPF is not activated . Basically  we do not want to store any expired cert. so these Cisco based trust certificates will be expired in 2023 , we can not regenerate them we can just upload new ones as  a -trust if needed . So we can delete them ..

[Roger Kallberg]

The shared document outlines the steps that you need to follow to renew and remove the old once.

[falling_d0wn]

We are running into the same problem with the CAP-RTP certs expiring in 2023.  The first of which is 2/6 so there is some urgency in finding a solution.  There is very little information available on CAP-RTP specifically other than it is pre-installed and related to MIC.  It cannot be re-generated but you also also cannot directly replace it either. Only the CAPF certs can be regened/replaced.  I have opened two different TAC cases on this and got two different answers - one said I MUST deploy LSC on my phones to keep them working before CAP-RTP expires.  The 2nd case outcome was to do nothing. Just delete them because they are not needed.  Our cluster has the CAPF service activated but we are not in mixed mode and use non-secure profiles on all our devices.  Is anyone able to give a clear answer on this topic?  Can the CAP-RTP certs simply be deleted without causing issues with your devices? 

Thanks

[extremum]

Hi,

We deleted them and do not encounter any issue , we are not using any security features .

[falling_d0wn]

Thank you for the response.  Did you restart the callmanager and capf services after you deleted them from the cluster?

[extremum]

We did not restart any service especially for the certificate deletion , they are trusted cert. we just delete them  on the pub . (sub side auto deleted after you delete them on the pub ) . We periodically restarting our cluster and we do not receive any issue for now .

[extremum]

As i know that if you use MIC based authentication you should convert to LSC before delete these certs. But we are not using any sec. feature so simply deleted them

[falling_d0wn]

We are not using any security profiles on the phones.  The documentation is confusing though and suggests that MIC is used for basic phone registration regardless.  

[BenBen]

I am working for a solution/suggestion/recommendation for this as well. There are several certificate renewal/regeneration documents floating around in addition to the security management guide. Not too much was said about CAP-RTP-001 and CAP-RTP-002 which are expiring on Feb 6, 2023!

Seriously we need to know what these two certificates are/were used for, and only Cisco can answer that question. I downloaded some MIC certificate from the ip phones, they were signed by "Cisco Manufacturing CA" with serial number "6a6967b3000000000003" which has an expiration date of  05/14/2029 (whew).

Will be much appreciated if anybody can share the experience to us.

Much thanks.