Use a real, trusted certificate for Click To Call

[oasislegal]

Hi everyone. I see there are instructions on how to install a certificate from Call Manager so that it is trusted by client computers on this page:

http://www.cisco.com/en/US/products/ps9829/products_tech_note09186a0080c157da.shtml

The process describes running a command on every client computer to install it into the trusted certificates store.

My question is, can I instead generate a certificate using a trusted authority (in this case our windows domain controller) and install it in the call manager. This seems better to me because all the computers will automatically trust it, without having to touch each machine.

Is it as simple as Generate CSR on call manager, create certificate on DC, upload to call manager? After uploading, can I specify that click to call should use the new trusted certificate instead of the self signed one?

And the million dollar question of course! Is there any possibility that this will break anything?

[Jonathan Schulenberg · Accepted solution]

Is there any possibility that this will break anything? 

Yes if your cluster is in mixed mode (i.e. doing TLS/IPsec-protected signaling or SRTP media encryption)

Is it as simple as Generate CSR on call manager, create certificate on DC, upload to call manager? 

Almost except you mean tomcat, not the callmanager process. You also need to restart the Tomcat service at the end of that sequence. Be sure that your certficate template on the MS CA matches the requirements:

http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/cucos/9_1_1/CUCM_BK_C5D96C80_00_cucm-os-admin-guide-91_chapter_0110.html#CUCM_RF_TF4B6BF0_00

Please remember to rate helpful responses and identify helpful or correct answers.

[oasislegal]

I can see the certificates in our Call Manager web interface in Cisco OS Administration>Security>Certificates.

When you say tomcat, are you saying I don't use the above, but should be in a different iterface?

Sorry I'm a bit of a noob with this...

[oasislegal]

Hi again Jon- thanks for the reply. I successfully installed the tomcat & tomcat-trust certificate tonight on our call managers.

For anyone else installing certiciates, this page showed step by step what you need to do.

http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_configuration_example09186a0080b43504.shtml

[ckgilliam]

I am attempting the instructions but on our windows server the web option is not listed any ideas?

Sent from Cisco Technical Support iPhone App