Signing ITL File

[Gordon Ross]

There is a CLI command to (re)sign the ITL file with CallManager certificate, but, unlike the CTL file, there's no command to sign the ITL file with the ITLRecovery certificate.

By some magic of restarting TVS & TFTP processes, I managed to get the ITL file signed by the ITLRecovery certificate, but that was luck rather than skill.

Is there a known process for signing the ITL file with the ITLRecovery certificate?

[Gordon Ross]

There is a CLI command to (re)sign the ITL file with CallManager certificate, but, unlike the CTL file, there's no command to sign the ITL file with the ITLRecovery certificate.

By some magic of restarting TVS & TFTP processes, I managed to get the ITL file signed by the ITLRecovery certificate, but that was luck rather than skill.

Is there a known process for signing the ITL file with the ITLRecovery certificate?

[Mohammed al Baqari]

You can use this command to sign the ITL cert with ITLRecovery instead of
callmanager.pem.

utils itl reset localkey

The you can verify using the command 'show itl' that will give

SUBJECTNAME 66 CN=*ITLRECOVERY_test10pub.joemar2.lab*
;OU=tac;O=cisco;L=rtp;ST=nc;C=U



**** please remember to rate useful posts

[Gordon Ross]

According to the docs, that command signs the ITL with the CallManager certificate...

[pkinane]

This is where that information came from. In case you want to learn more.

https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/117598-technote-itl-00.html

In newer CUCM versions the ITL file is signed by the ITLRecovery by default.