Cisco Unified Communications Operating System Administration Guide for Cisco Unity Connection Release 10.x

Display Certificates

To display existing certificates, follow this procedure:

Procedure

Step 1 Navigate to Security > Certificate Management.

The Certificate List window displays.

Step 2 You can use the Find controls to filter the certificate list.

Step 3 To view details of a certificate or trust store, click its file name of the certificate under Common Name..

The Certificate Details window displays information about the certificate.

Step 4 To return to the Certificate List window, click Close on Certificate Details window.

Download a Certificate

To download a certificate from the Cisco Unified Communications Operating System to your PC, follow this procedure:

Procedure

Step 1 Navigate to Security > Certificate Management.

The Certificate List window displays.

Step 2 You can use the Find controls to filter the certificate list.

Step 3 Click the file name of the certificate under Common Name.

The Certificate Details window displays.

Step 4 Click Download.PEM File or Download.DER File.

Step 5 In the File Download dialog box, click Save.

Delete and Regenerate a Certificate

These sections describe deleting and regenerating a certificate:

• Deleting a Certificate
• Regenerating a Certificate

Deleting a Certificate

To delete a trusted certificate, follow this procedure:

Caution Deleting a certificate can affect your system operations. Any existing CSR for the certificate that you choose from the Certificate list gets deleted from the system, and you must generate a new CSR. For more information, see the Generating a Certificate Signing Request for Single Server and Multi-Server Certificate.

---

Procedure

Step 1 Navigate to Security > Certificate Management.

The Certificate List window displays.

Step 2 You can use the Find controls to filter the certificate list.

Step 3 Click the file name of the certificate under Common Name.

The Certificate Details window displays.

Step 4 Click Delete.

Regenerating a Certificate

To regenerate a certificate, follow this procedure:

Caution Regenerating a certificate can affect your system operations.

---

Procedure

Step 1 Navigate to Security > Certificate Management.

The Certificate List window displays.

Step 2 Click Generate Self-signed or Generate CSR.

The Generate Certificate dialog box opens.

Step 3 Choose a certificate name from the Certificate Name list. For a description of the certificate names that display, see Table 6-1 .

Step 4 Click Generate.

Note After you regenerate certificates in Cisco Unified Communications Operating System, you must perform a backup so that the latest backup contains the regenerated certificates. If your backup does not contain the regenerated certificates and you must perform restoration tasks for any reason, you must manually unlock each phone in your system so that the phone can register with Cisco Unified Communications Manager. For information on performing a backup, refer to the Disaster Recovery System Administration Guide.

Upload a Certificate or Certificate Trust List

Note The system does not distribute trust certificates to other cluster nodes automatically. If you need to have the same certificate on more than one node, you must upload the certificate to each node individually.

These sections describe how to upload a CA root certificate, application certificate, or CTL file to the server:

• Upload a Certificate
• Upload a Certificate Trust List
• Upload a Directory Trust Certificate

Upload a Certificate

Procedure

Step 1 Navigate to Security > Certificate Management.

The Certificate List window displays.

Step 2 Click Upload Certificate/Certificate chain.

The Upload Certificate/ Certificate chain dialog box opens.

Step 3 Select the certificate name from the Certificate Purpose list.

Step 4 Select the file to upload by doing one of the following steps:

• In the Upload File text box, click the Browse button and navigate to the file; then, click Open.

Step 5 To upload the file to the server, click the Upload File button.

Upload a Certificate Trust List

Procedure

Step 1 Navigate to Security > Certificate Management.

The Certificate List window displays.

Step 2 Click Upload Certificate.

The Upload Certificate Trust List dialog box opens.

Step 3 Select the certificate name from the Certificate Name list.

Step 4 If you are uploading an application certificate that was issued by a third-party CA, enter the name of the CA root certificate in the Root Certificate text box. If you are uploading a CA root certificate, leave this text box empty.

Step 5 Select the file to upload by doing one of the following steps:

• In the Upload File text box, enter the path to the file.
• Click the Browse button and navigate to the file; then, click Open.

Step 6 To upload the file to the server, click the Upload File button.

Upload a Directory Trust Certificate

Procedure

Step 1 Navigate to Security > Certificate Management.

The Certificate List window displays.

Step 2 Click Upload Certificate.

The Upload Certificate Trust List dialog box opens.

Step 3 Select directory-trust from the Certificate Name list.

Step 4 Enter the file to upload in the Upload File field.

Step 5 To upload the file, click the Upload File button.

Step 6 Log into Cisco Unified Serviceability.

Step 7 Navigate to Tools > Control Center - Feature Services.

Step 8 Restart the service Cisco Dirsync.

Step 9 Log in to the Cisco Unified Communications Operating System CLI as an administrator.

Step 10 To restart the Tomcat service, enter the command utils service restart Cisco Tomcat.

Step 11 After the services have been restarted, you can add the directory agreement for SSL.

Using Third-Party CA Certificates

Single-server and Multi-server Certificates Overview

As the name suggests, Single-server certificate contains single FQDN which identifies the trust for that FQDN only. The single FQDN or domain is present in Subject Alternative Name (SAN) extensions. If there are multiple servers in a cluster, then the system requires the generation of an equal number of X.509 certificates, one for each server.

The system uses a multi-server certificate to identify the trust for multiple servers or domains or sub-domains. The SAN extensions of a multi-server certificate contain multiple FQDNs or domains.

Note In telephony integration, multi-server SAN certificate is supported only with secure SIP integration. However, with secure SCCP integration, only single-server certificate is supported.

The following table describes the basic differences between single-server and multi-server certificates.

Cisco Unified Communications Operating System supports certificates that a third-party Certificate Authority (CA) issues with PKCS # 10 Certificate Signing Request (CSR).

The following table provides an overview of this process, with references to additional documentation:

	Task	For More Information
Step 1	Login to Cisco Unified Communications Operating System Administration window.	Note Cisco Unified Communications Operating System Administration allows the system administrator to select the distribution type, when generating a CSR for the individual certificate purposes that supports the multi-server option. The system automatically populates the CSR with the required SAN entries and displays the default SAN entries on the screen. On generating a multi-server CSR, the system automatically distributes that CSR to all the required servers in the cluster. Similarly, on upload of a multi-server CA signed certificate, the system automatically distributes that certificate to all the required servers in the cluster
Step 2	Generate a CSR on the server.	See the “Generating a Certificate Signing Request for Single Server and Multi-Server Certificate” section.
Step 3	Download the CSR to your PC.	See the “Download a Certificate Signing Request for Single-Server Certificate and Multi-Server Certificate” section.
Step 4	Use the CSR to obtain an application certificate from a CA.	Get information about obtaining application certificates from your CA. See “Obtaining Third-Party CA Certificates” section for additional notes.
Step 5	Obtain the CA root certificate.	Get information about obtaining a root certificate from your CA. See “Obtaining Third-Party CA Certificates” section for additional notes.
Step 6	Upload the CA root certificate to the server.	See the “Upload a Certificate” section.
Step 7	Upload the application certificate to the server.	See the “Upload a Certificate” section.
Step 8	Restart the services that are affected by the new certificate.	For all certificate types, restart the corresponding service (for example, restart the Tomcat service if you updated the Tomcat certificate). In addition, if you updated the certificate for CAPF or Cisco Unified Communications Manager, restart the TFTP service. Note If you updated the Tomcat certificate, you also must restart the Connection IMAP Server service in Cisco Unity Connection Serviceability. See the Cisco Unified Communications Manager Serviceability Administration Guide for information about restarting services.

Generating a Certificate Signing Request for Single Server and Multi-Server Certificate

Procedure

Step 1 Select Security > Certificate Management.

The Certificate List window displays.

Step 2 Use the find control to filter the certificate list.

Step 3 Click Generate CSR.

The Generate Certificate Signing Request dialog box opens.

Step 4 From the Certificate Purpose drop-down list box, select the required certificate purpose.

Step 5 From the Distribution drop-down list box, select the required distribution list item.

Note The Multi-server (SAN) option is available only when you select tomcat from the Certificate Purpose drop-down list box.Click Generate CSR.

Note By default, the system populates the CN field with the server FQDN (or hostname). You can modify the value, if required. For self-signed certificate, the CN is not configurable.

Step 6 For Multi-server (SAN), additional domains can be added in Additional Domain field.

Step 7 From the Key Length drop-down list box, select 1024 or 2048.

Step 8 From the Hash Algorithm drop-down list box, select SHA1 or SHA256.

Step 9 Click Generate to generate a new CSR.

Note The new CSR that is generated for a specific certificate type overwrites any existing CSR for that type. The CSR is automatically distributed to all the required servers in the cluster.

Download a Certificate Signing Request for Single-Server Certificate and Multi-Server Certificate

To download a Certificate Signing Request, follow this procedure:

Procedure

Step 1 Select Security > Certificate Management.

The Certificate List window displays.

Step 2 From the list, click the Common Name of the entry with type 'CSR Only' and a Distribution value matching the Common Name.

Note For multi-server SAN certificate, click the Common Name of the entry with type 'CSR Only' and a Distribution value of 'Multi-Server (SAN)'.

The CSR Details window appears.

Step 3 Click Download CSR.

Step 4 After the CSR download completes, click Close.

You need to restart the tomcat service after configuring the Multi-server SAN certificate on both Publisher and Subscriber in a cluster. See the procedure below:

Procedure

Step 1 Sign in to the Unity Connection server by using an SSH application.

Step 2 Run the following CLI command to restart the Tomcat service:

utils service restart Cisco Tomcat

Obtaining Third-Party CA Certificates

To use an application certificate that a third-party CA issues, you must obtain both the signed application certificate and the CA root certificate from the CA. Get information about obtaining these certificates from your CA. The process varies among CAs.

CAPF and Cisco Unified Communications Manager CSRs include extensions that you must include in your request for an application certificate from the CA. If your CA does not support the ExtensionRequest mechanism, you must enable the X.509 extensions that are listed on the final page of the CSR generation process.

Cisco Unified Communications Operating System generates certificates in DER and PEM encoding formats and generates CSRs in PEM encoding format. It accepts certificates in DER and PEM encoding formats.

For all certificate types except CAPF, obtain and upload a CA root certificate and an application certificate on each node.

For CAPF, obtain and upload a CA root certificate and an application certificate only on the first node.

CAPF and Cisco Unified Communications Manager CSRs include extensions that you must include in your request for an application certificate from the CA. If your CA does not support the ExtensionRequest mechanism, you must enable the X.509 extensions, as follows:

• The CAPF CSR uses the following extensions:

• The CSRs for Cisco Unified Communications Manager, Tomcat, and IPSec use the following extensions:

Upload the CA root certificate of the CA that signed an application certificate. If a subordinate CA signs an application certificate, you must upload the CA root certificate of the subordinate CA, not the root CA.

You upload CA root certificates and application certificates by using the same Upload Certificate dialog box. When you upload a CA root certificate, choose the certificate name with the format certificate type -trust. When you upload an application certificate, choose the certificate name that only includes the certificate type. For example, choose tomcat-trust when you upload a Tomcat CA root certificate; choose tomcat when you upload a Tomcat application certificate.

Monitor Certificate Expiration Dates

The system can automatically send you an e-mail when a certificate is close to its expiration date. To view and configure the Certificate Expiration Monitor, follow this procedure:

Procedure

Step 1 To view the current Certificate Expiration Monitor configuration, navigate to Security > Certificate Monitor.

The Certificate Monitor window displays.

Step 2 Enter the required configuration information. See Table 6-3 for a description of the Certificate Monitor Expiration fields.

Step 3 To save your changes, click Save.

Certificate Revocation

You can use the Online Certificate Status Protocol (OCSP) to obtain the revocation status of the certificate.

To configure OCSP, follow this procedure:

Procedure

Step 1 Navigate to Security > Certificate Management.

The Certificate List window displays.

Step 2 Check the Enable OCSP check box in the Online Certificate Status Protocol Configuration area.

Step 3 Choose Use OCSP URI from Certificate if the certificate is configured with OCSP URI and that to be used to contact OCSP Responder.

Step 4 Choose Use configured OCSP URI if external or configured URI is used to contact OCSP Responder. Enter the URI of the OCSP Responder, where certificate revocation status is verified, in the OCSP Configured URI field.

Step 5 Check the check box for Enable Revocation Check to perform the revocation check.

Note The certificate revocation service is active for LDAP and IPSec connections, when revocation and expiry check enterprise parameter is set to enabled.

Step 6 Enter the Check Every value to check the periodicity of the certificate revocation status.

• Click Hours or Days to check the revocation status hourly or daily.

Step 7 Click Save.

Warning You must upload the OCSP Responder certificate to tomcat-trust before enabling OCSP.

Note The Certificate revocation status check is performed only during upload of a Certificate or Certificate chain and the appropriate alarm will be raised if a certificate is revoked. The Cisco Certificate Expiry Monitor service must be restarted to ensure certificate revocation. Navigate to Cisco Unified Serviceability > Tool > Control Center - Network Services and restart the Cisco Certificate Expiry Monitor service.

Generating IPSEC Certificate

To generate or regenerate the ipsec certificate on standalone or cluster, follow this procedure::

Procedure

Step 1 Navigate to Security > Certificate Management.

The Certificate List window displays.

Step 2 Click Generate Self-signed > or > Generate CSR.

Step 3 Select ipsec from the Certificate Purpose drop-down list.

Step 4 Click Generate.

After generating the certificate, ipsec and ipsec trust will be updated with the certificate for standalone or publisher server.

Step 5 In case of subscriber server, follow Step 1 to Step 4 for generating ipsec certificate. After generating, download the ipsec certificate from subscriber server.

Step 6 Navigate to Security > Certificate Management on subscriber server.

Step 7 Click Upload Certificate/Certificate Chain.

The Upload Certificate Trust List dialog box opens.

Step 8 Select the ipsec-trust from the Certificate Purpose drop-down list.

Step 9 Browse the certificate and click Upload.

Step 10 After uploading the ipsec certificate to subscriber server, restart the below services first on publisher server and then subscriber server.

• Cisco DRF Master
• Cisco DRF Local

Set Up a New IPSec Policy

To set up a new IPSec policy and association, follow this procedure:

Note Because any changes that you make to an IPSec policy during a system upgrade will get lost, do not modify or create IPSec policies during an upgrade.

Caution IPSec, especially with encryption, will affect the performance of your system.

---

Procedure

Step 1 Navigate to Security > IPSEC Configuration.

The IPSEC Policy List window displays.

Step 2 Click Add New.

The IPSEC Policy Configuration window displays.

Step 3 Enter the appropriate information on the IPSEC Policy Configuration window. For a description of the fields on this window, see Table 6-4 .

Step 4 To set up the new IPSec policy, click Save.

Managing Existing IPSec Policies

To display, enable or disable, or delete an existing IPSec policy, follow this procedure:

Note Because any changes that you make to an IPSec policy during a system upgrade will get lost, do not modify or create IPSec policies during an upgrade.

Caution IPSec, especially with encryption, will affect the performance of your system.

---

Caution Any changes that you make to the existing IPSec policies can impact your normal system operations.

---

Procedure

Step 1 Navigate to Security > IPSEC Configuration.

Note To access the Security menu items, you must log in to Cisco Unified Communications Operating System Administration again by using your Administrator password.

The IPSEC Policy List window displays.

Step 2 To display, enable, or disable a policy, follow these steps:

a. Click the policy name.

The IPSEC Policy Configuration window displays.

b. To enable or disable the policy, use the Enable Policy check box.

c. Click Save.

Step 3 To delete one or more policies, follow these steps:

a. Check the check box next to the policies that you want to delete.

You can click Select All to select all policies or Clear All to clear all the check boxes.

b. Click Delete Selected.