[cisco-voip] Wrong ITL cert on subscribers

[Eric Pedersen]

We had to rebuild our CUCM 12.5 publisher. That part went ok, but now the subscribers have an ITLRecovery certificate that differs from the pub and are giving out an ITL file signed with that certificate. The publisher has the old, correct certificate which is got with the restore, but it looks like the subscribers for some reason got the ITL cert that the publisher generated after the build but before the restore. Phones are fine if the publisher is their TFTP server but reject the ITL file if a subscriber is their TFTP server.

TAC is saying we need to regenerate the ITL recovery certificate and then the ITL file which sounds extremely risky. I can't see why this would be necessary since the publisher certificate is correct.  Does anyone have experience with an issue like this? Changing CUCM certificates always makes me nervous. My nightmare situation is that we would have to factory reset all the phones.

Eric
 
Bennett Jones is committed to mitigating the spread of COVID-19. We have 
transitioned to a remote work environment and continue to provide 
complete and uninterrupted service to our clients.  Visit our COVID-19 
Resource Centre (https://www.bennettjones.com/COVID-19) for timely 
legal updates.
 
The contents of this message may contain confidential and/or privileged 
subject matter. If this message has been received in error, please contact 
the sender and delete all copies. Like other forms of communication, 
e-mail communications may be vulnerable to interception by unauthorized 
parties. If you do not wish us to communicate with you by e-mail, please 
notify us at your earliest convenience. In the absence of such 
notification, your consent is assumed. Should you choose to allow us to 
communicate by e-mail, we will not take any additional security measures 
(such as encryption) unless specifically requested. 

If you no longer wish to receive commercial messages, you can unsubscribe 
by accessing this link:  http://www.bennettjones.com/unsubscribe
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20200610/1c92342d/attachment.htm>