CUCM Expired tomcat-trust certs

[Tyson Villeneuve]

Hi all. Running CUCM 8.6.1

I have a few expired tomcat-trust certificates. I'm trying to sort through the process of generating new ones, but I'm wondering something:

How do I find out which of these certs are actually being used? I assume not the expired ones...

I have a PUB and 5 SUBs, and the expired certs are named for the SUB they're associated with, but how do I know if that SUB is now using another trust cert? Also, I want to just delete all the expired ones and see what happens (I'll stop getting these annoying emails), but is there any reason to keep the expired certs around?

Thanks

[Dennis Mink · Accepted solution]

If you know which ones have expired, then why are you not replacing those with with new ones, be it self signed, or signed by a CA?

[Tyson Villeneuve]

They were replaced. Looks like the old ones are just in there, still.

[Dennis Mink]

well if they are expired and replaced with new ones for the same hostname, by all means get rid of them.

[Tyson Villeneuve]

My question had to do with how I know if they've been replaced by new ones for the same hostname. Do I only need one Tomcat-trust for each node?

[alfredobosca]

I have regenerated the tomcat certificate but the tomcat-trust og uccx member1 wasn't regnerated.Meanwhilte the tomcat-trust on member2 was regenrated automatically.

could know if this tomcat-trust is used?

Best regards.

[Deepak Rawat · Accepted solution]

There is no reason to keep the expired certs on the server. There is a possibility that you might have regenerated the tomcat and associated tomcat-trust certificates already but because the expired tomcat-trust certificates have not been deleted you are getting these emails. Verify this by going into OS Administration >> Security >> Certificate Management >> Find. This will list all of your certificates, you only need to focus on the ones that shows as tomcat and tomcat-trust. Open the tomcat certificate and see the expiry date if its expired simply click on regenerate which will also regenerate the associated tomcat-trust certificates. If it is not showing as expired then leave it as it is and look for all the tomcat-certs individually and keep deleting the ones which are expired.

Note: Do the above process for all the servers that are reporting as expired certs. Please ensure that you are restarting Cisco Tomcat service using CLI once the certificates had been regenerated

Regards

Deepak

[Tyson Villeneuve]

Great. I assume I can do the same thing with expired CallManager-Trust certs?

Thanks

[Deepak Rawat]

That is very well true for CallManager-certs as well however please be aware of below defect and remove the expired CallManager-Trust certs in  after hours:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCut58407/?referring_site=bugquickviewredir

Reference Document:

http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200199-CUCM-Certificate-Regeneration-Renewal-Pr.html

Regards

Deepak

[Tyson Villeneuve]

Deepak,

Let me just try to clarify this a little before moving forward.

First of all, how can I tell which node a cert is associated with. I don't see anything in the cert that shows this. Several of my tomcat-trust certs are named NodeName.domain.loc.pem, but others have various other names. Looking at the certs on the GUI's of different nodes I see different certs, though. Does this mean the cert is associated with the Node I'm viewing it from?

Secondly, do I only need one tomcat and one tomcat-trust cert on each server?

Thanks