SSO / CUCM 12.5 use ITLRecovery or Tomcat MultiSan cert

[rchaseling]

Hi,

Just wondering if there is any downside to using the ITLRecorvery cert for enabling SSO? Does this involve pushing out the ITLRecovery Cert to all PC endpoints?

As Companies are all only signing internal certs for 1 year now - it creates a bit of overhead having to re-do the SSO agreement every year for multiple customers

As the ITLRecovery it valid for 15 years or so this would avoid that I assume?

Thoughts?

[Nithin Eluvathingal]

For SSO we  use tomcat.  ITLrecovery is used for signing ITL/CTL. 

I recently signed my UC server with valid of 3 years and I face no issues but not for  SSO. 

Public signed CA certs are for one year. 

[rchaseling]

Screenshot from 12.5 SU4

[Nithin Eluvathingal]

I believe Thats a new enhancement, on my 12.5(1) version it never mentioned ITL recovery.  Never did SSO on SU4 so didn't notice this change. 

When talking about Self signed we consider its a least secure certificate. And some  organisation doesn't show interest in  using self signed certs. 

Both self signed and CA signed works if you do it correctly.