Tomcat-Trust certificate expired; IM&P getting old one

[james.buchanan1]

On a UCM 10.5 cluster, we have replaced the expired Root CA certificate with a new one. We disabled certificate change notification on all servers in the UCM cluster and the IM&P intercluster sync agent. Then, we deleted the Root CA certificate. After we deleted the Root CA certificate, we started these services again and uploaded a new version of the Root CA certificate.

All the CUCM servers in the cluster received the new Root CA certificate from the CUCM Publisher. However, the IM&P servers received an outdated version of that same certificate.

Is there a defect of some sort in which the old version of the certificate is stored somewhere and is propagated through the Intercluster Sync Agent?

[brianw2]

Yes there was a defect regarding what I believe you are experiencing. It is noted in CSCuy13916.

Have you tried deactivating and re-activating the TFTP service on your IM&P servers?

[james.buchanan1]

Yes. Turns out there is an old version of the trust certificate still in the CUCM database even though the cert is gone from the list in Platform Administration. So, I'll call my good friends at TAC to perform some Informix magic.