CUCM Certificates!

[Stuart C]

Hi, 

I have some Tomcat certificates that have expired, self-signed not CA signed.  Everything appears to be working however.  I notice I have EC and RSA types.  The RSA ones have expired, but the EC are still valid.  

Can someone advise why nothing is broken, is it because of the in date EC certificates?

Thanks

[Dennis Mink]

tomcat certs are used for instance when you pull up the cucm portal, because they are self signed it would pop up an notification saying you cant trust the cert. you can import it and trust it, and no questions asked. even if it expires.  with certs signed by a trusted CA, this is a different matter.

this is why nothing has broken.

[Stuart C]

Hi,
So I don’t even need to re-generate them?
Because I have other self-signed certs that have expired too (ipsec, call-manager, TVS, CAPF) So are you saying I don’t need to renew these?
Thanks

[R0g22]

I don't think that's what Dennis meant. He answered your query as to why nothing broke even with expired certs.
You should regenerate them. Even if you are not using secure voice/secure access, you won't at least get RTMT alerts for this.
Recommended is to have CA signed but does not seem like certificates are a concern for your organisation.

[Stuart C]

I had to regenerate Tomcat as it effected Finesse logins when it expired. However I still have the ones I listed as expired. I will get them all regenerated.
Thanks

[Jaime Valencia]

Make sure to review the ITL/SBD and certificate regeneration documentation before doing so, to avoid ITL problems.

[Stuart C]

Hi Jaime,
Thanks for the advice. Do you have a link to the document?
Also, I have many other self-signed certs that aren’t in date. Why are there not more things broken? For example, IPSEC cert which I thought was used for backups, but backups aren’t affected by this out of date cert?
Thanks