Expressway Certificates

[JustForVoice_2]

Hello Everyone,

I have a question regarding Expressway certificates. As you know, I have to install certificates between C and E to create a traversal zone. And to disable the pop-up after login from Internet, I have to install a public signed certificate.

My question is, can I install certificates as below:

Expressway-C: ONLY a signed certificate from my own CA (inside the organization).

Expressway-E: a signed certificate from my own CA and another certificate signed by Public CA.

Regards,

[Jaime Valencia]

Yes, simply install all the root certs as necessary so they trust each other.

[JustForVoice_2]

Thank you for your support,

but how Jabber/Expressway will know which certificate to use? Do I need to configure something?

[Jaime Valencia]

Have you reviewed the MRA guides???

Jabber clients must verify the identity of the VCS Expressway they are connecting to by validating its server certificate. To do this, they must have the certificate authority that was used to sign the VCS Expressway's server certificate in their list of trusted CAs.

http://www.cisco.com/c/dam/en/us/td/docs/telepresence/infrastructure/vcs/config_guide/X8-7/Mobile-Remote-Access-via-VCS-Deployment-Guide-X8-7.pdf

[Mohamed Amine Jaafar]

One Expressway server (Expressway -C or -E) uses a single and only one certificate when communicating with servers/clients eg Jabber.

But a server can verify the identify of multiple servers through certificates signed with different authorities.

To make a server trust the certificate of another party, you mustadd the root certificate of the CA that signed/generated that certificate to its trusted root certificate store..

Expressway communicates with his (single) certificate but can trust many.