CUCM v14(SU3) certificates regeneration

[Michalis Papasavva]

Hi,

For mix mode cluster, before version 14 i know you need to update CTL file for CAPF, Call manager and TVS certificates and restart services with below order.

1. Upload certificates
2. Run the utils ctl update CTLFile only on Publisher
3. Restart services.
4. Restart all phones from enterprise parameters

On version 14, in enterprise parameters the "Phone interaction on Certificate Update parameter is automatically reset" by default. So when the regeneration of certificate the phones automatically reset to update ITL file. 

I need to set Phone interaction on Certificate Update  to manually and proceed with the above order of regeneration of certificates or doesn't matter if the phones restart before updating the CTL file?

[Marco Rojas Abarca · Accepted solution]

Hello Michalis,

You can take advantage of tool called CUCM Certificate Planner Tool available here:

https://cway.cisco.com/csa-new/#/aiguidedworkflows

You can used the Tailored approach, which will generate a step-by-step process on what you will need to do.

Here is the information you will need to use this tool:

Complete System Version?
Mixed mode enabled?
SSO enabled?
LSC configured?

Collect the output from running the following command in VOS CLI:

run sql select c.servername, tcs.name, dist.moniker, c.ipv4address, c.certificate from certificate as c inner join certificateservicecertificatemap as cscm on c.pkid = cscm.fkcertificate inner join typecertificateservice as tcs on cscm.tkcertificateservice = tcs.enum inner join typecertificatedistribution as dist on c.tkcertificatedistribution = dist.enum

Save the CLI outputs (without making any changes) to a .txt or .log file.

Hope this information helps,
Marco R.

[Michalis Papasavva]

Thank you Marco

[Maren Mahoney]

I also HIGHLY recommend the Cisco UC Certificates Renewal Guide written by @Roger Kallberg:

Cisco UC Certificates Renewal Guide 

Maren