Cisco Cisco Expressway
Note: If you are using Unified CM version 8.5(1) or earlier and are having problems establishing a TLS
connection between Expressway and Unified CM, we recommend adding the following x509 extended key
attributes into the CSR:
connection between Expressway and Unified CM, we recommend adding the following x509 extended key
attributes into the CSR:
n
serverAuth (1.3.6.1.5.5.7.3.1) -- TLS Web server authentication
n
clientAuth (1.3.6.1.5.5.7.3.2) -- TLS Web client authentication
n
ipsecEndSystem (1.3.6.1.5.5.7.3.5) -- IP security end system
Expressway trusted CA certificate
The
Trusted CA certificate
page (
Maintenance > Security certificates > Trusted CA certificate
) allows
you to manage the list of certificates for the Certificate Authorities (CAs) trusted by this Expressway. When
a TLS connection to Expressway mandates certificate verification, the certificate presented to the
Expressway must be signed by a trusted CA in this list and there must be a full chain of trust (intermediate
CAs) to the root CA.
a TLS connection to Expressway mandates certificate verification, the certificate presented to the
Expressway must be signed by a trusted CA in this list and there must be a full chain of trust (intermediate
CAs) to the root CA.
The root CA of the Unified CM server certificate must be loaded into the Expressway's trusted CA certificate
list.
list.
To upload a new file containing one or more CA certificates, Browse to the required PEM file and click
Append CA certificate. This will append any new certificates to the existing list of CA certificates. If you
are replacing existing certificates for a particular issuer and subject, you have to manually delete the previous
certificates.
Append CA certificate. This will append any new certificates to the existing list of CA certificates. If you
are replacing existing certificates for a particular issuer and subject, you have to manually delete the previous
certificates.
Repeat this process on every Expressway that will communicate with this Unified CM.
Loading Server and Trust Certificates on Unified CM
Certificate management for Unified CM is performed in the
Cisco Unified OS Administration
application.
All existing certificates are listed under
Security > Certificate Management
. Server certificates are of type
certs and trusted CA certificates are of type trust-certs.
Unified CM server certificate
By default, Unified CM has a self-signed server certificate CallManager.pem installed. We recommend that
this is replaced with a certificate generated from a trusted certificate authority.
this is replaced with a certificate generated from a trusted certificate authority.
Unified CM trusted CA certificate
To load the root CA certificate of the authority that issued the Expressway certificate (if it is not already
loaded):
loaded):
1. Click Upload Certificate/Certificate chain.
2. Select a Certificate Name of CallManager-trust.
3. Click Browse and select the file containing the root CA certificate of the authority that issued the
Expressway certificate.
4. Click Upload File.
Repeat this process on every Unified CM server that will communicate with Expressway. Typically this is
every node that is running the CallManager service.
every node that is running the CallManager service.
Cisco Unified Communications Manager with Cisco Expressway (SIP Trunk) Deployment Guide (X8.6)
Page 22 of 37
Connecting Expressway to Unified CM Using TLS