Cert About to Expire (CUC)

[silvervoip]

Hello,

We are about to renew ipsec certificate on unity cluster. I was wondering once we get this completed, will user be asked to accept new certs on their Jabber (both PC & cell phones)?

Certificate name: ipsec.der

               Unit: ipsec

               Type: own-cert

Thanks.

[Nithin Eluvathingal]

if user devices  has installed Root CA who signed your certificate, you wont get the certificate warning. if not  with new certificate, users will be asked to accept.

[silvervoip]

Hi,

How can I make sure that user devices have Root CA cert? The cert I am talking about is self-signed so does that mean users will be asked to accept new cert?

[Jaime Valencia]

You need to download the certificate, and then distribute it to the devices, or have them accept the new certificate. This is covered in the Jabber documentation.

[Nithin Eluvathingal]

The above reply is related to certificate warnings. The certificate which you mentioned  has no effect with jabber users .

[Roger Kallberg]

AFAIK The ipsec cert has no relevance for Jabber users.

[Jaime Valencia]

You're absolutely right, missed that, it's Tomcat the one that is used with Jabber.

[Roger Kallberg]

@Jaime Valencia 

Why did you only give 1 helpful vote on this? Second question how do one even change the number of votes given, I've always seen that it gives 5 when you press the Star?

[Jaime Valencia]

I have absolutely no idea, I just gave you a helpful vote on that last comment but it does that automatically, I don't do anything differently, just click on the star. I don't get to choose the number of stars/helpful votes. Not sure if that might be due to being a Cisco employee. I'll ask the CSC team about that.

[RG979797 · Accepted solution]

You don't have to worry about it. The only thing an expired IP Security cert will stop is the DRS backups.  

You can renew the IP Sec root cert from CUC pub and it will be replicated to the rest of the nodes. You will need to regenerate each of the expired IP sec service cert on all nodes individually. No service restart is needed!

This can be done during office hours. Done it many many times.