Cisco Expressway SSH tunnel failure for UC traversal zone

[ragz3000]

uniSSH tunnel status is failed however the UC traversal zone is active.

Below is the error message on expressway c

2020-02-04T17:01:44.444+11:00

portforwarding: Level="ERROR" Detail="Client control socket open failed" forwarding="localhost:8191:localhost:8192" user="_pfwd" host="expresswaye01.xyz.com.au" id="d21dfe99-4713-11ea-8b7b-005056010a53" retcode="255" err="ssh_x509store_cb: subject='C=AU,ST=Victoria,L=Richmond,O=xyz pvt Ltd,CN=expresswaye01.xyz.com.au', error 20 at 0 depth lookup:unable to get local issuer certificate ssh_verify_cert: verify error, code=20, msg='unable to get local issuer certificate' " UTCTime="2020-02-04 06:01:44,443"

2020-02-04T17:01:44.443+11:00

ssh: Event="sshd" Module="openssh" Level="INFO" Detail="ssh_dispatch_run_fatal: Connection to 10.30.136.29 port 2222: invalid certificate" UTCTime="2020-02-04 06:01:44"

2020-02-04T17:01:44.441+11:00	ssh: Event="sshd" Module="openssh" Level="INFO" Detail="RSA+cert host key for IP address '10.30.136.29' not in list of known hosts." UTCTime="2020-02-04 06:01:44"
2020-02-04T17:01:44.328+11:00	portforwarding: Level="WARN" Event="Alarm Raised" Id="35013" UUID="a19a462a-cf7e-4b6f-b333-33b2e502ec0b" Severity="warning" Detail="Unified Communications SSH tunnel failure: This system cannot communicate with one or more remote hosts: expresswaye01.xyz.com.au" UTCTime="2020-02-04 06:01:44,327"

[Adam Pawlowski]

It appears to be upset that it’s a locally issued cert or doesn’t have the CA certificate in trust

[ragz3000]

The secure traversal test results success under UC traversal zone.

The zone status itself is Active.

I generated CSR from exp-c and have this signed by internal CA.

Downloaded signed server certificate and uploaded it to exp-c.

Also I uploaded CA root into Trusted CA certificate in both exp-c and exp-e.

Any more pointers to check will be helpful, thanks.

[ssparkes]

Hi,  Im having the same issue.  Have you made any progress with this?

[rajaayman]

HI 

Just verify the CA confg as per the below link  nic video my Mr. Jamie

https://www.youtube.com/watch?v=FIqh3rSIUmA

and recreate certificate for both the server and check  and verfiy the FQDN created in local dns server  .

[ragz3000]

I have expressway-edge server certified by public CA. However I did not install those root certs onto the expressway-core server. Due to this exp-c was complaining about the certificate error. Once I uploaded the public root CAs on exp-c, issue resolved. hope this helps.

[Roger Kallberg]

Have a look at this excellent document. It covers pretty much all things about certificates in Expressway.

https://www.cisco.com/c/en/us/support/docs/unified-communications/expressway/213872-configure-and-troubleshoot-collaboration.html

[Adam Pawlowski]

There's a note about using self signed certificates for things where I think you can't use them for everything in a MRA setup - I don't know off the top of my head where that point is.

You would have to look in the actual debug logging to see if it had a complaint about the certificate validation.