CUC Certificates

[RL5901]

I have a HA CUC cluster. I recently noticed that our certificates on the cluster have already expired. I have not observed any adverse effects of the expired certificates.

These certificates are:

• On the Primary ...
  • ipsec - Primary is common name
  • ipsec-trust - Primary is common name
  • tomcat - Primary is common name
  • tomcat-trust 
    • One for the Primary,
    • One for the Secondary, 
    • One for the "Call Home Server Certificate" signed by Verisign
• On the Secondary ...
  • ipsec - Secondary is common name
  • ipsec-trust - Secondary is common name
  • tomcat - Secondary is common name
  • tomcat-trust
    • One for the Secondary
    • One for the Primary
    • One for the "Call Home Server Certificate" signed by Verisign

My questions are,

1. Do I need to renew these expired certificates?
2. What are the consequences of not renewing these certificates?
3. If it is advisable to renew the certificates then what is the recommended procedure for doing so?

[Roger Kallberg]

The recommendation is to always renew and keep all of your certificates valid. Please have a look at this document for the procedure for this. Cisco UC Certificates Renewal Guide 

[RL5901]

The odd thing is, DRF is continuing to backup CUC with no errors (with an expired ipsec.pem certificate). I didn't expect to find that. 

[Roger Kallberg · Accepted solution]

It’s likely because you have not restarted the service that use that certificate. It keeps the certificate in memory and does not reload it until next restart.

[Nithin Eluvathingal · Accepted solution]

My questions are,

1. Do I need to renew these expired certificates? Thumb Rule, Renew the certificates which expired and going to expire. 
2. If it is advisable to renew the certificates then what is the recommended procedure for doing so? Refer link  @Roger Kallberg shared

Two  days back I faced an  issues with the DRF backup due to a expired certificate. If you didn't face an  issues, doesn't mean that its not required. Proactive is better than reactive. 

[RL5901]

Then I'll get this in front of our CCB to approve doing this asap. 

Thank you for the information, everyone.