Upload 3rd party Tomcat .pem in CuCM

[agup]

We are running CuCM version 9.1(2). Currently we have Verisign signed Tomcat cert running on CuCM. It is time for renewal and we submitted to Verisign the .csr for renewal.

Verisign says they can't provide .cer as we were expecting, instead they are going to provide us .pem certificate.

Questions:

1. Can I upload .pem to CuCM as it is or do I need to convert .pem cert in .cer prior to upload?

2. If I can upload .pem as it is received, is it same steps as .cer upload or different?

3. How do I verify if .pem has all the right info like server name, SAN etc

4. If I need to convert .pem to .cer prior to uploading .cer, how do I do it?

Please let me know if more info required.

Thanks in Advance for all answers.

[Dennis Mink · Accepted solution]

you can upload pem files straight into cucms as per:

Cisco Unified Communications Manager Release 8.6 supports Privacy Enhanced Mail (PEM) Base64 encoded format of X.509 certificate (only one PEM certificate in a file), Distinguished Encoding Rules (DER) format of X509 Certificate and DER format of PKCS#7 (Public-Key Cryptography Standards) Certificate Chain. The system does not support PEM format of PKCS#7 Certificate Chain.

(this is taken of a 10.5 cucm)

[Jaime Valencia]

There is only one procedure to upload certificates, no matter the extension.

The last two questions, you just need to google, and you will find sites that show you the decoded contents of the pem file, and the procedure to change certificates from X to Y format.