tomcat cucm

[Will Phinney]

Everyone,

I recently had my main tomcat cert expire on my call managers and am struggling to figure all of this out. I opened a TAC case, but can't seem to grasp the whole cert idea. I have a 3 node cluster and each server has a tomcat.pem file with 3 trust certs for each box. I have the main cert signed by my domain controller and after talking with TAC they informed me to delete the old trust certs and regenerate the main tomcat.pem cert on each box, however, by regenerating it I don't believe it will "push out" the expiration date. I need to do this, but can't seem to get my head around these certs and don't want to keep bother TAC. Furthermore, don't I need to get a new cert from my dc and then upload the new cert to each cucm nodes? Thanks in advance for all the help. Also, are all certs this hard?

[Aaron Harrison]

Hi Will

Are all certs this hard? No.. but then some are harder.

This could be implemented better, and documented better... but basically:

As I recall, there is no concept of 'renewing' a cert (there is generally, but not in CUCM). You basically generate a new one.

Go into OS Admin, Cert Mgmt, and you would issue a new CSR by hitting Generate CSR. 

In the Generate CSR box, generate a 'tomcat' CSR. This box has lots of new boxes, it's better than it used to be...  Common Name/SAN had to be set in the CLI previously.

Use the CSR on your CA to generate the cert (your DC that runs MS CA, or whatever your clients trust)

Then obtain and upload the Root CA public cert, and any intermediate certs if you have them (i.e. if you have separate root and issuing CAs) to Cert Mgmt as 'tomcat-trust' certs.

Finally, upload the generated cert to CUCM as a 'tomcat' cert.

[Will Phinney]

Aaron,

Thanks for the reply. So I guess that's where my confusion was at when I read 'generate' I thought it was just going to generate a new cert then extend the date, however, I understand now that I need to generate that and send it to my DC, then upload the new cert and start tomcat. I need to do this for all three of my servers, but will those trust certs be pushed to each servers? With Tomcat can I get away with not rebooting all my phones and just restart the tomcat service? Thanks, Aaron.

[Aaron Harrison · Accepted solution]

Hi

If I recall correctly the trust certs get replicated round. The tomcat cert itself won't, so do it per server.

You may even already have the trust certs in if you are using a cert from the same DC already..

Yes, you can just restart Tomcat from the server CLI.

Aaron

[Will Phinney]

Aaron,

Finally got around to uploading certs to each cucm box and I "think" it worked, as I no longer see expired certs and each tomcat trust cert renewed the new date, but I still error on the browser saying site is potentially dangerous. I thought that would be cleared up with the new cert from my DC? Thanks again!

[Aaron Harrison]

Hi

Two things need to happen to avoid errors (well - more, like the cert has to be valid and in date etc... but for you):

- You must browse to the server using the hostname or SAN listed in the cert. Not IP.

- Your PC must trust the cert authority. You would normally distribute your CA certs (if they are MS ones) through AD, but this might not have happened for some reason. To trust it, load the root cert (not the CUCM server cert) into the Trust Roor Cert Authorities folder on your PC cert store. If it then works, get your AD peeps to see why it didn't happen automatically.

Regards

Aaron

[Will Phinney]

Actually, I was going to the server by IP. Once I went to the actual hostname that the cert was ok with, no error. Thanks again for the assist.