Generate Tomcat CSR (Multi-Server SAN)

[kmlpuri10]

I am facing the problem while generating tomcat CSR for Multi-Server (SAN). When I select Multi-Server (SAN) both publisher and subscriber are Auto-populated. But for Publisher, it is not showing FQDN. For subscriber it is showing full FQDN. Attachment is there for more clarification. Will there be any problem if i generate CSR like that or it is mandatory to have FQDN of both server? If yes, how can i add FQDN? Also certificate of subscriber is already expired. Can I renew both with this process? or have to do separately?

[collinks2]

Go to system/server. ensure the cucm has fqdn.if not ,fix it.then
regenerate the certificate.
remeber to remove ms that appears in the FQDN of pub and sub

[kmlpuri10]

Hi @collinks2 ,

There is IP address of both publisher and subscriber. Not FQDN. Subscriber is showing FQDN with IP address entry in System>Server. Then Why should we change this? 

When I run below command in publisher, it shows below:

admin:show network eth0
Ethernet 0
DHCP : disabled Status : up
IP Address : 53.249.244.168 IP Mask : 255.255.255.192
Link Detected: yes Mode : Auto disabled, Full, 10000 Mbits/s
Duplicate IP : no

DNS
Primary : 53.249.244.19 Secondary : 53.66.67.249
Options : timeout:5 attempts:2
Domain : Not configured
Gateway : 53.249.244.129 on Ethernet 0

Could this be the reason: Domain Not configured. How can we configure this? Configuring this will re-generate all certificate?

[collinks2]

Hi ,go to cli of cucm use the command below

set network domain

[kmlpuri10]

And will that generate new certificates? Will there be any impact on the
server/services after setting it up?

[kmlpuri10]

And will that generate new certificates? Will there be any impact on the server/services after setting it up?

[collinks2]

Yes it will renegeare the certificates..

[Roger Kallberg]

If you do not want to have warnings on your Jabber clients you should have your servers defined as FQDN on this page. On the domain part of your question, yes that’s what causes the name in the CSR creation to just be a host name and not a FQDN. It is also the reason for why you don’t see a domain in the domain part of the CSR creation.

On your question about the effect on defining the domain, I would think that you’d be needed to create and populate a new certificate on the account of this. For additional information on certificate creation please see this document. Cisco UC Certificates Renewal Guide 

[kmlpuri10]

Hi @Roger Kallberg ,

Does that mean generating the certificate without Publisher FQDN doesn't work? or only with Hostname also should work? We don't have IM & Presence. Have only Unity connection.

[Roger Kallberg]

I’ve never even contemplated what the effect of this would be, so I cannot say for sure. But if I where to venture into a guess I would say that without a FQDN the entry for the node in the certificate would be invalid as it would not be possible to resolve the name of the node. With this the entry in the certificate can not be validated when a client is to connect.

[collinks2]

@roger, pls can you help me comment on this thread
https://community.cisco.com/t5/telepresence-and-video/email-template-and-email-scheduler/m-p/4590744#M104289

[Roger Kallberg]

Sorry @collinks2 I don’t have any experience of CMS, so I can’t help you out with this.

[collinks2]

@roger
ok.thanks

[kmlpuri10]

Hi @Roger Kallberg ,

To your reply: If you do not want to have warnings on your Jabber clients you should have your servers defined as FQDN on this page.

If warning on jabber client is fine, can we use without FQDN? Or will there be any impact on the services also ?

[Roger Kallberg]

If you can live with the warning it should be no affect to the service. But I don't see the whole issue with fixing the actual underlying issue. It's a simple matter that would not take you that much time to do. Live by the motto Do it right or don't do it at all as that will save you time overall.