Cisco Cisco TelePresence Video Communication Server Expressway
VCS trusted CA certificate
The
Trusted CA certificate
page (
Maintenance > Security certificates > Trusted CA certificate
) allows
you to manage the list of certificates for the Certificate Authorities (CAs) trusted by this VCS. Certificates
presented to the VCS must be signed by a trusted CA on this list and there must be a full chain of trust
(intermediate CAs) to the root CA.
presented to the VCS must be signed by a trusted CA on this list and there must be a full chain of trust
(intermediate CAs) to the root CA.
The root CA of the Unified CM server certificate must be loaded into the VCS's trusted CA certificate list.
To upload a new file of CA certificates, Browse to the required PEM file and click Append CA certificate.
This will append any new certificates to the existing list of CA certificates. Note that if you are replacing
existing certificates for a particular issuer and subject, you have to manually delete the previous certificates.
This will append any new certificates to the existing list of CA certificates. Note that if you are replacing
existing certificates for a particular issuer and subject, you have to manually delete the previous certificates.
Repeat this process on every VCS that will communicate with this Unified CM.
Loading server and trust certificates on Unified CM
Certificate management for Unified CM is performed in the
Cisco Unified OS Administration
application.
All existing certificates are listed under
Security > Certificate Management
. Server certificates are of type
certs and trusted CA certificates are of type trust-certs.
Unified CM server certificate
By default, Unified CM has a self-signed server certificate CallManager.pem installed. We recommend that
this is replaced with a certificate generated from a trusted certificate authority.
this is replaced with a certificate generated from a trusted certificate authority.
Unified CM trusted CA certificate
To load the root CA certificate of the authority that issued the VCS certificate (if it is not already loaded):
1. Click Upload Certificate/Certificate chain.
2. Select a Certificate Name of CallManager-trust.
3. Click Browse and select the file containing the root CA certificate of the authority that issued the VCS
certificate.
4. Click Upload File.
Repeat this process on every Unified CM server that will communicate with VCS. Typically this is every
node that is running the CallManager service.
node that is running the CallManager service.
Setting the Cluster Security Mode to Mixed Mode
The Cisco Unified Communications Manager cluster must be in Mixed Mode to allow the registration of both
secure devices and non-secure devices. This allows for best effort encryption between the VCS and the
Cisco Unified Communications Manager. Read
secure devices and non-secure devices. This allows for best effort encryption between the VCS and the
Cisco Unified Communications Manager. Read
background on best effort encryption between VCS and Unified CM.
As of version 10.0, you can use the CLI to change the cluster security mode. On earlier versions, you must
use the Cisco CTL Client plugin to change the cluster security mode. The security mode change updates the
CTL file, so you must restart the Cisco CallManager and Cisco Tftp services after the change.
use the Cisco CTL Client plugin to change the cluster security mode. The security mode change updates the
CTL file, so you must restart the Cisco CallManager and Cisco Tftp services after the change.
The process is summarized below, but you should refer to the Cisco Unified Communications Manager
Security Guide for your version, which you can find on the
Security Guide for your version, which you can find on the
Unified CM with Cisco VCS (SIP Trunk) Deployment Guide (X8.1)
Page 28 of 46
Connecting VCS to Unified CM using TLS