Cisco Cisco Expressway

Cisco

Contents

Introduction

PKI introduction

Overview of certificate use on the Expressway

Certificate generation overview

Generating a certificate signing request (CSR)

Creating a CSR using Expressway

Server certificates and clustered systems

Server certificate requirements for Unified Communications

Authorizing a request and generating a certificate using Microsoft Certification
Authority

Loading certificates and keys onto Expressway

Loading a server certificate and private key onto Expressway

Managing the trusted CA certificate list

Managing certificate revocation lists (CRLs)

Automatic CRL updates

Manual CRL updates

Configuring revocation checking for SIP TLS connections

Appendix 1: Troubleshooting

SIP TLS negotiation failures on neighbor and traversal zones

Certificates with key length of 8192 bits

Service failures when using mobile and remote access

Appendix 2: Certificate generation using OpenSSL only

Creating a certificate request using OpenSSL

Operating as a Certificate Authority using OpenSSL

Configuring OpenSSL to act as a CA

Creating a Certificate Authority using OpenSSL

Creating a signed certificate using OpenSSL

Creating self-signed certificates using OpenSSL

Appendix 3: Converting a DER certificate file to PEM format

Appendix 4: Decoding certificates

Appendix 5: Configuring Windows Server Manager with a "client and server"
certificate template

Document revision history

Cisco Expressway Certificate Creation and Use Deployment Guide (X8.2)

Page 2 of 29