CUCM Certificate Regeneration - service impact?

[TONY SMITH]

Hi,

I need to regenerate expired certificates on a live CUCM 9.1 cluster.  Could I just sanity check on service impact, by which I mean impact on calls and on SCCP and SIP registered phones?   My understanding is that there should be no impact when regenerating Tomcat and IPSec certificates.   Is this correct?  Last time I did this was all within a change window so I didn't care if the phones did a soft reset, and I don't remember if they did.

Thanks, Tony S

[Slavik Bialik]

Hi,
If you'll regenerate the Tomcat certificate and then restart the Cisco Tomcat service, it might only affect Jabber users with some error which will disappear in a few minutes, and if someone will try to access service like Corporate Directory for example, they'll fail to do that. But nothing more then that. About IPSec certificates... well, for what are you using them exactly? Can't be really sure about it.
Anyway, the phones won't restart.

[Chris Deren]

I concur with Slavik (+5), you need to list which self signed certs you are re-generating as they all provide different purpose thus have different impact, i.e. regenerating callmanager certs for example or even deleting expired callmanager trust store certs will cause phones to reset due to ITL cert updates.