Single Trust Certificate for CUCM 10.5.1

[ahamedulla jainudeen]

Hi, 

I would like to know , the single trust certificate name which is recently revised in the cisco, available for multiple servers (one publisher with 7 subscribers) instead of applying all the trusted certificates (ie. IP Sec,tomcat certificate etc.,) in the cluster individually. So that if we regenerate and download csr of this single certificate in the publisher it can be synchronized automatically with all the subscribers.

help me to know in detail about this.

Call Manager version# 10.5.1 

Cluster# publisher with seven subscriber.

Regards

AZ.

[Ayodeji Okanlawon]

The feature is called cucm multi SAN (subject alternate name) 

Please refer to this doc.. 

http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/118731-configure-san-00.html

.. 

It is very easy to use. When generating your csr just select multi SAN, from the drop down menu. Same when uploading the signed cert 

[ahamedulla jainudeen]

Thanks @Ayodeji...

Thanks a lot....

[KY_]

Hi,

I have same question, I have two cucm and two im&p server. When I loggin in to to jabber locally its asking me  certificate not valid alert for every server. (cucm and im&p servers)

TAC suggested me multi-SAN with which is signed by my external CA certificate authority.

My question is that;  What will I do ?  Do need to upload certificated directly expressway-c or should I signed from my CA authority ?

Will this cause any problem on the phones after that? (ctl or phones registration issues ?

Thanks

[Chris Deren]

You need Tomcat cert from CUCM, IMP (if using SAN cert it would be the same), Unity Connection, as well as XMPP cert on IMP servers to be trusted by the client. It can be signed by external CA (ideal especially mobile clients), which you'd have to purchase, or you can sign these by internal CA if you have one, but then you would need a way to upload the root/intermediate certs from this CA to all clients, where mobile clients i.e. iPhone would require pushing them via MDM type solution. 

Uploading new certs requires service restart i.e. Cisco Tomcat which would break the web access to the application for couple of minutes. There are many threads and documents on the exact procedure.

[KY_]

Thanks for reply Chiris,

Will this cause any problem on the phones after that? especialy phone registration or etc.?

Thanks

[Chris Deren]

No, Tomcat and XMPP certs have nothing to do with phones.