CMS with Expressway Public vs. internal CA Certificate Requirements

[Nick Halbert-Lillyman]

I've been reading through the certificate requirements for CMS and the guides are currently focused on either single combined deployment, or split deployment of CMS, rather than CMS + Expressway.

I'm trying to confirm if I still need my Web bridge and XMPP server signed by a public CA if I'm using Expressway for all external connectivity (i.e. WebRTC)?  Or do I only need a public certificate on Expressway-E, providing it has the guest join URI as a SAN?

[DenysAdams]

On your expressway E you just need the Certificate  SAN of the guest join URI, and your good to go,

be aware if your using Expressway E only.

Branding does not work
And External CMA does not work 

[Nick Halbert-Lillyman]

OK thanks - so Webbridge on CMS can just use the internal CA or in most cases the same internal certificate as the Callbridge and Webadmin etc?

[DenysAdams]

Yes, because the Expressway E will be the point of access and its certificate is checked, just be sure that your expressway C trusts your CMS.

Also you may want WebRTC internally in your organisation so, sign it with an Internal CA,
that way internally you can browse to the CMS Webbridge for webRTC

[Ingeniero de Soporte Noc Micronet]

Hello,

did you get this issue resolved?

Im having the same problem, and I´m curios about how the webbridge certificate (CSR, public or internal CA) need to be created and how the dns internal record configured.

thanks!

[Zoltan Kelemen]

I recommend the following rule of thumb:

• whatever needs to be accessed by clients not controlled by you should have certificates signed by a trusted public CA
• internal services that never get accessed by end-users and/or are only for server to server connections, are free to use internal CA.

If you have control over all internal users, or having a certificate warning pop-up is considered acceptable, you can use an internal CA.

more details on CMS Certificates and DNS requirements.