Good Day All,
We are using signed certificates on our CUCM version 7.1 CUCM PUB and SUB, CUC server, and CUPS server.
The certificates have expired.
I have found some documentation on generating a new certificate and that all sounds good, but I just wanted to ask people some questions about the process.
1. Do I need to install the certificate seperately on each server CUCM-PUB and CUCM-SUB, CUC, and CUPS. (they go in the OS area so I think I will need to install each seperately.)
2. Is there any specific order to installing the certificates?
3. Will installing a new certificate impact the running telephones. (We are not using encryption)
4. Does the work need to take place out of hours?
Also, if there are any 'gotchas' from someone who has been there before.... that would be great.
Appreciate any info.
Regards
Amanda
| Task | For More Information |
|---|
Step 1: | Generate a CSR on the server. | See the Generating a Certificate Signing Request topic. |
Step 2: | Download the CSR to your PC. | See the Download a Certificate Signing Request topic. |
Step 3: | Use the CSR to obtain an application certificate from a CA. | Get information about obtaining application certificates from your CA. See Obtaining Third-Party CA Certificates topic for additional notes. |
Step 4: | Obtain the CA root certificate. | Get information about obtaining a root certificate from your CA. See Obtaining Third-Party CA Certificates topic for additional notes. |
Step 5: | Upload the CA root certificate to the server. | See the Upload a Certificate topic. |
Step 6: | Upload the application certificate to the server. | See the Upload a Certificate topic. |
Step 7: | If you updated the certificate for CAPF or Cisco Unified Communications Manager, generate a new CTL file. | See the Cisco Unified Communications Manager Security Guide. |
Step 8: | Restart the services that are affected by the new certificate. | For all certificate types, restart the corresponding service (for example, restart the Tomcat service if you updated the Tomcat certificate). In addition, if you updated the certificate for CAPF or Cisco Unified Communications Manager, restart the TFTP service. Note : If you updated the Tomcat certificate, you also must restart the Connection IMAP Server service in Cisco Unity Connection Serviceability. See the Cisco Unified Communications Manager Serviceability Administration Guide for information about restarting services. |
