decrypting UCCX traffic with Firepower

[tato386]

Hello,

I need to get the private key of the tomcat cert that is installed on my UCCX for this.  From my research it seems that it is not feasible or even possible to extract it from the OS but it seems like I should be able to create a cert and key with OpenSSL and then import the files into the OS.  So now I have a public CA signed cert and the private key for this cert but cannot find a way to import it.

I have tried both GUI and CLI.  I have tried with standard and passwordless PKCS12.  I have tried with un-encrypted key in PEM file.  Nothing seems to work.  Has anybody had success in doing this?  Would TAC be able to help me?

Thanks,

[Roger Kallberg]

What is your use case for decrypting UCCX traffic in Firepower?

[tato386]

traditionally we have not exposed the Finesse desktop interface to the Internet but this has caused a mish-mash of access methods.  We have some users that use RDP to access from an inside machine, others that VPN in and also kept a static list of public IPs allowed thru the firewall.  We feel that making sure we keep abreast of patches and use all the security features available on the FTD platform it will mitigate the risk to an acceptable level and allow users to just hit the Finesse URL directly from the Internet. 

[Roger Kallberg]

In general it is a quite bad idea to allow access to your contact centre system from internet. I would recommend you to not do that. Agents who are located off the corporate premises should use some sort VPN service to access their agent front end.

On your question, on a CVOS system you cannot access the private key of the certificate, nor can you create the certificate off system and upload it to the system. TAC will not help you with getting the private key.

[Elliot Dierksen]

I strongly agree with @Roger Kallberg on this. Finesse is not sufficiently hardened for it to be accessible directly from the internet. That is a a very risky idea.

[tato386]

thanks for the advice.  we will certainly keep your recommendations in mind.