Webex Certificate based LGW issue - CA question

[shanes]

Hello, FYI this is a lab environment, I have a certificate based trunk setup. I followed the Webex guide to setting up a certificate based trunk (LGW). My question revolves around the certificate itself. It says that Webex only accepts "WEBEX approved CA certificates only". I have an internal ADCS that I use to sign my Cube certificate. I install the CA cert and the CA signed router cert. In the guide it also tells me to run the command:

crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b

After this I followed the guide and completed setup I get the following:

Status

 Offline

TLS Connection from Local Gateway failed due to a certificate error. 

Trunk Type Certificate based

Device

Cisco Unified Border Element

My primary question is can I use the internal ADCS to sign my router cert and it is valid to the webex platform? If not where do I send my CSR to get signed?

Thank you for any assistance.

[Roger Kallberg]

No you can not use an internal CA. You need to use an external public CA that is in the list of approved CAs for Webex.

[Roger Kallberg]

This article lists the approved CAs. https://help.webex.com/en-us/article/WBX9000008850/What-Root-Certificate-Authorities-are-Supported-for-Calls-to-Cisco-Webex-Audioand-Video-Platforms?

[shanes]

Thank you so much for replying so quickly. My issue is finding the CA servers from that list that will sign my router CSR and provide those CA signed certificates. Maybe I am missing an important step in understanding how to put the provided bundles to use. Do I download the provided CA bundles before I run the pki enroll process. Its just pretty ambiguous to me because I have not been able to get it to work. I'm sure once it actually works for me it will click lol.

[Roger Kallberg]

This article might help you. IOS CA - basic deployment; certificate enrollment and signing process. 

[shanes]

Thank you again for responding!