Unity Connection 7.x and CSR generation

[sdavids5670]

A client of mine has a Unity Connection server and the tomcat cert is about to expire.  I

generated a CSR for tomcat using the OS admin console and gave it to the client to submit to his CA.  He responded to me that the CSR I provided was 1024 bit and that his CA only accepts 2048 and higher.  I do not recall being able to specify a bit length during CSR generation.  Is there a way to do that thru the CLI or by some other means?

[bvanturn · Accepted solution]

Hi,

It is not possible to specify this. Starting 8.0(3) it defaults to 2048 bit though.

CSCso62711    Cert Manager should generates Tomcat CSR using RSA 2048 instead of 1024

There is also an enhancement defect open to let the user choose though with the implementation of default to 2048 it is not so relevant any more.

So in order to achieve this you will need to upgrade your server.

[sdavids5670]

Thank you very much for your response.  Quick follow-up question. What are the ramifications of allowing the cert to expire?  What, if anything, will stop working?  Or will the browser just show a message stating that the certificate is expired but still allow the page to render?  Also, I'll feel bad if I don't ask....is there an engineering special for 7.x that will allow me to generate a CSR of 2048 bit length or is 8.x the only option?

[bvanturn]

I have not tested it explictly but indeed I would simply expect the browser to throw a popup about the certificate being expired. Simple test is to put the clock of your client forward compared to the server and then you will see this popup/browser error about the certificate. If you have a test server you can cimply turn forward time on it as well.