Are CTL / ITL certificates used by AnyConnect? Why are there two hashes in phone config?

[esa_fresa]

Are the CTL / ITL certificates in CUCM the same certificates that are put into the phone configuration to be used by AnyConnect for IP Phone vpn?

And a follow up question. Why does my phone config have two certificate hashes?

<credentials>

<hashAlg>0</hashAlg>

<certHash1>Hy2hWyNUwlvxxx...=</certHash1>

<certHash2>SznAL6KKbv9kexxx...=</certHash2>

</credentials>

[Manish Gogna · Accepted solution]

Hi,

Specific certificate requirements for CUCM and ASA when using ANyconnect are detailed here

http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/115785-anyconnect-vpn-00.html#anc5

These are different from the ITL/CTL certs which are used by all IP phones on cucm cluster.

HTH

Manish