[SOLVED] IP-Phone CSR generation on freshly installed CUCM

[Arvyr]

Hello,

I got a CUCM cluster version 11.5 and a test installation of a CUCM version 12.5 where none of the connected phones would generate a certificate signing request.

Since I couldn't find any guide on the internet I wanna ask here, if there's a comprehensive step-by-step guide on how to enable

CUCM and Phones to work with certificates?

It's primarily needed for 802.1x authentication but secure voice later on with an Offline CA (Windows Server based).

FYI: The 11.5 cluster already uses valid certificates from a Windows CA, the 12.5 is still "virgin" in this regard.

Any help is appreciated.

[Gregory Brunn]

This require mix mode in CUCM for secure voice.  Also for the LSC you need mix mode. 

For 802.1X typically the LSC is used which is signed by the CAPF.   

Have you read the following

https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/TrustSec_1-99/IP_Tele/IP_Telephony_DIG.html

Also check out the cisco live sessions for CUCM security there are some good sessions done on this topic on how phones use certificates.

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/12_5_1/cucm_b_security-guide-1251.html

Also there are some great session for

[Arvyr]

Thanks for the links, I will look into them.

One thing however, I read in another document I can't find right now, that mixed-mode isn't needed for phones when only 802.1x is wanted and not secure voice.

Is this correct?

Also, since my 12.5 CUCM is in eval mode, I can't activate mixed-mode.

On my 11.5 cluster, mixed-mode is enabled however, still no CSRs are generated.

Is there a way to see what's happening?

With RTMT or via CLI?

[Roger Kallberg]

You should read the documents provided by @Gregory Brunn and then if you still have questions please get back in this post. There is an obvious lack of understanding on your end for how certificates are used and handled in CM.

[Gregory Brunn]

There is a great cisco live on demand session that has a presentation video on the basics

Introduction to Cisco UC Security - BRKCOL-2014

[Arvyr]

Hello again,

so I watched that cisco live session and it was indeed a good source of theoretical information.

It's lacking practical parts however.

I found a solution to my problem though. 

After searching other posts in this forum I stumbled across: https://community.cisco.com/t5/ip-telephony-and-phones/phones-don-t-install-lsc-after-mixed-mode-configuration/td-p/2931516

and indeed, switching from dns to ip helped in generating LSCs. I need to check my dns configuration in the future.

So phones now have a valid certificate and are able to communicate encrypted.

Thanks for all the hints.