PCD Migration - CUCM 11.5-15.0 - Question about CallManager/TVS Certs

[kylebrogers]

If I have an 11.5 CUCM cluster with expired CallManager and TVS Certs, do I have regen them before the migration or will the new 15.0 version accept the expired certs for import.

I would prefer to regen the certs once the cluster is on 15.0 rather than doing it on an old, EoS version of CUCM, but I don't know if 15.0 will refuse the expired certs during import/install.  

[Roger Kallberg]

I don’t know about if v15 would refuse to accept the expired certificates, but in general it’s a rather bad idea to run a system with expired certificates. My recommendation would be to renew them in your current system. To do so please have a look at this document. Cisco UC Certificates Renewal Guide 

[kylebrogers]

Thanks, I agree and don't plan on leaving the certificates expired, but I would rather renew them on v15 since I can get support if I run into issues as opposed to 11.5, which is EoS.  So I'm trying to find out specifically if I can move from 11.5 to 15 with the expired certs, then renew them once I'm on 15.  

[Nithin Eluvathingal]

It’s not a good idea to perform migrations with expired certificates. I recommend renewing the certificates before proceeding with the migration.

[kylebrogers · Accepted solution]

In case anyone else needs to know this, I was able to do the migration with the expired certs and then regenerate them after the migration.  

[Nithin Eluvathingal]

In fact, the migrations would definitely work; however, they are not recommended. Performing migrations and upgrades with expired certificates is not good practice. It is also recommended to run the pre-upgrade checks, expired certificates will definitely cause failures in the pre-check. There is always a high risk of encountering problems when best practices are not followed. However, the choice is personal—either to proceed in their own way or to follow the recommendations.