CUCM Certificates

[George Clark]

Need some assistance we have a cluster with 4800 phones 1 Pub, 4 Subs and 2 tftp  servers the only server that is expiring is on the publisher which is the callmanager cert since all our phones are registered to the subscribers none on the publisher, do the phones have to be reset we have 3800 phones ????

Or can i just regenerate the cert on the publisher all callmanager certs are fine on the subs and tftp ....

[Chris Deren]

What version is your CUCM as it works different for 11.5+ vs. previous. Does this cert exist on other CUCM nodes?  If so, deleting/regenerating it will reset the phones, in either way do it during maintenance window as the resets are unpredictable (some related bugs exists) and even if you delete expired certs I've seen phones reset.

[George Clark]

Thanks, we are version 11.5 the cert is valid on all other servers in the cluster they don't expire till 2021 so I thought since no phones are on the publisher they would not require a reboot we are 7X24 ...

[Chris Deren · Accepted solution]

So, is it about to expire or does not expire until 2021?  In either case certs are replicated across all nodes, and in version 11.5 if you delete it from Pub that cert also gets deleted on Subs.  Since the cert is part of trust store (ITL cert) deleting any of the CallManager certs even if no devices use it will impact those devices, and it's likely you will see the phones reset.