CUCM & CUC Certificates

[silvervoip]

Hello Community,

I would like to have a look at the certificates on both CUCM & CUC and if any of certificate is about to expire, I will renew it. However, I am not %100 sure which certificates are mandatory to check? Could you help me about it?

Thank you.

[Shalid Kurunnan Chalil · Accepted solution]

Hi,

the certificate fulfillment depends on how you are set up the infrastructure. But the basic certificates required in UCM is Tomcat and CallManager.

If you are running version higher than 8.6 ( i think), you only need to upload the certificate in Publisher node.

Optionally depends on your secured setup, you may need to look into IPsec and CAPF.

Basically, there are 2 methods to generate the certificates, 

• Regenerate a certificate - where the Cisco call manager sign the certificate itself (self Signed)
• Generate a CSR - where it require some CA has to sign the CSR to turn it into a certificate.

Similarly, in CUC, you should be looking at the tomcat certificate. 

in both applications, the certificate management is available under Cisco Unified Operating System Administration >> Security >> Certificate Management. 

there are plenty of references available, please find some reference as below;

CUCM Uploading CCMAdmin Web GUI Certificates

High Level View of Certificates and Authorities in CUCM

Regards,

Shalid 

Please remember to rate useful posts, by clicking on the stars below.

[silvervoip]

Hello Shalid,

Thank you for detailed explanation. However, one more question appeared for me.

If you are running version higher than 8.6 ( i think), you only need to upload the certificate in Publisher node.

Yes, higher than 8.6 so, Will publisher send copy to other subscribers? or storing only on Publisher is enough?

Thank you.

[Chris Deren]

It is not true that 8.6 allows uploading certs to only one node, you can generate multi-SAN CSR from the Pub that will include all other nodes and then you just sign the single SAN certificate and upload it to the Pub which propagates it to other nodes in the cluster, but I believe that was added in CUCM 10.  If you are getting regular CN certificate you will need to generate the CSR separately on each node and upload to each node the signed cert.

[Shalid Kurunnan Chalil]

Thanks, Chris for the correction. 

I read somewhere about it but unfortunately couldn't find it now.  clear about it that as per the docs, from Cisco call manager release 10.5 onwards it support Multi server SAN.

"Unified Communications Manager adds support for multiserver certificates which allows the administrator to assign a single certificate for a given certificate unit (for example; Tomcat, CallManager, cup-xmpp, and cup-xmpp-s2s) across multiple servers in a cluster"

Regards,

Shalid

[Chris Deren]

All certificates are important and need not to be expired, some certificates commonly get signed by external CAs and some are left self signed, in any case you should never let any certs externally signed or self-signed to expire. The CUCM security guide goes over the certs in decent details and explains which cert is used for what purpose.