<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Verdana; font-size: 10pt; color: #000000'>Are these HTTPS services on the phone's internal web server or HTTPS services somewhere else that you use the phone's web browser to access?<br><br>If the later, are we seeing more CCM services/apps (like CCMUser) that the phones access pushing towards HTTPS?<br><span><br><span name="x"></span>---<br>Lelio Fulgenzi, B.A.<br>Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1<br>(519) 824-4120 x56354 (519) 767-1060 FAX (ANNU)<br>^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^<br>Cooking with unix is easy. You just sed it and forget it. <br> - LFJ (with apologies to Mr. Popeil)<br><span name="x"></span><br></span><br><hr id="zwchr"><b>From: </b>"Matthew Loraditch" <MLoraditch@heliontechnologies.com><br><b>To: </b>"Lelio Fulgenzi" <lelio@uoguelph.ca>, "Jason Burns" <burns.jason@gmail.com><br><b>Cc: </b>"Cisco VOIP" <cisco-voip@puck.nether.net><br><b>Sent: </b>Wednesday, June 20, 2012 1:03:37 PM<br><b>Subject: </b>RE: [cisco-voip] Couple misc. CTL/certificate questions...<br><br>
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">You can set the cluster to pre-8.x mode and this will turn off all of the security by default features for the phones. You will not be able to use https phone
services, etc, but you also won’t have to worry about anything except your certs on ccmadmin access. It’s a judgement call really as to whether to do it or not.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D"> </span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Matthew G. Loraditch – CCNP-Voice, CCNA, CCDA<br>
</span><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#1F497D"><br>
1965 Greenspring Drive</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><br>
</span><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#1F497D">Timonium, MD 21093</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><br>
</span><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#1F497D"><br>
voice. 410.252.8830<br>
fax. 410.252.9284 <br>
<br>
<a href="http://twitter.com/heliontech" target="_blank">Twitter</a> | <a href="http://www.facebook.com/#%21/pages/Helion/252157915296" target="_blank">
Facebook</a> | <a href="http://www.heliontechnologies.com/" target="_blank">Website</a> | <a href="mailto:support@heliontechnologies.com?subject=Technical%20Support%20Request" target="_blank">
Email Support</a></span><span style="font-size:11.0pt;font-family:"Arial","sans-serif";color:#1F497D"></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> cisco-voip-bounces@puck.nether.net [mailto:cisco-voip-bounces@puck.nether.net]
<b>On Behalf Of </b>Lelio Fulgenzi<br>
<b>Sent:</b> Wednesday, June 20, 2012 12:58 PM<br>
<b>To:</b> Jason Burns<br>
<b>Cc:</b> Cisco VOIP<br>
<b>Subject:</b> Re: [cisco-voip] Couple misc. CTL/certificate questions...</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">This whole security things gives me the willies. ;)<br>
<br>
Is it possible to upgrade to 8.x/9.x and turn security off? Any reason to turn it on? Just seems like yet another thing to worry about.
<br>
<br>
Good god, can you imagine DST time changes and certificates expiring at the same time?<br>
<br>
---<br>
Lelio Fulgenzi, B.A.<br>
Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1<br>
(519) 824-4120 x56354 (519) 767-1060 FAX (ANNU)<br>
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^<br>
Cooking with unix is easy. You just sed it and forget it. <br>
- LFJ (with apologies to Mr. Popeil)<br>
<br>
</span></p>
<div class="MsoNormal" style="text-align:center" align="center"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">
<hr id="zwchr" align="center" size="2" width="100%">
</span></div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">From:
</span></b><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">"Jason Burns" <<a href="mailto:burns.jason@gmail.com" target="_blank">burns.jason@gmail.com</a>><br>
<b>To: </b>"Ed Leatherman" <<a href="mailto:ealeatherman@gmail.com" target="_blank">ealeatherman@gmail.com</a>><br>
<b>Cc: </b>"Cisco VOIP" <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<b>Sent: </b>Wednesday, June 20, 2012 12:18:43 PM<br>
<b>Subject: </b>Re: [cisco-voip] Couple misc. CTL/certificate questions...<br>
<br>
Ed,<br>
<br>
Good catch on the CAPF certs on every node. You're right that they just get ignored on the subscriber nodes. I'm not sure myself what function they serve as the only useful CAPF cert is the one from the publisher.<br>
<br>
Since you're on 7.X and you're about to enable security but this isn't a new install, I would definitely recommend taking a look at all of your certificate expiration dates. They're typically 5 years from creation for the self signed certificates (install date).
Personally, I would regenerate:<br>
<br>
CAPF.pem - Publisher<br>
CallManager.pem - All Nodes <br>
<br>
before I enabled security with the CTL client and USB tokens. This means you'd have 5 years before ever having to worry about running the CTL client again for certificate expiration. You may have to run it again if you changed other things that regenerated
certs (host name change), and it's easy to run again, but why worry about it. You'll also have 5 years before CAPF expires, which gives you a guaranteed 5 year life time before worrying about any LSCs signed by this CAPF (since the LSC is what gets pushed
to the phones and they're signed by CAPF).<br>
<br>
Now is also a good time to point the cluster to an SMTP email server, as well as populate an email address in the Certificate Monitor fields in OS Administration. This will notify someone before that 5 year timer pops.<br>
<br>
Once you've regenerated CAPF and CallManager certificates you'll want to restart CAPF on the pub and CCM on all nodes. If you can't restart CCM for operational reasons then I'd skip the CallManager.pem regen step but still perform the CAPF regen step. We want
to make sure we don't have to mess with any CAPF or LSC regeneration for another 5 years.<br>
<br>
Enable security and push LSCs to the phones.<br>
<br>
In 4 years and some months you'll get an email telling you the CAPF cert is about to expire. You also know that all of your LSCs are about to expire. You can take proactive action to generate a new CAPF cert, run CTL client, reset phones, and use BAT to push
new LSCs to phones.<br>
<br>
<br>
If this is 8.X you can still regenerate the CAPF.pem, but don't touch the CallManager.pem unless you have to.<br>
<br>
-Jason</span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">On Wed, Jun 20, 2012 at 9:12 AM, Ed Leatherman <<a href="mailto:ealeatherman@gmail.com" target="_blank">ealeatherman@gmail.com</a>> wrote:</span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">I'm getting ready to install security tokens soon on CM 7.1, and noticed a few things while I was pulling my plan together. I was hoping someone might know the
answer(s)</span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">- While looking around at the existing certs on my cluster (non-secure mode right now) I noticed a CAPF.pem on every node, with a different serial numbers and
CNs. I thought this should only exist on the publisher? Does it just ignore the certs on the other nodes when i put the cluster in mixed mode?</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">- Also while poking around - once again, non-secure mode - I noticed all the CallManager.pem files have varying expiration dates on them (seems to coincide with
when I refreshed hardware). Some of them expire as early as 2014.. would it be a good idea to refresh the certs now so that they have later expiration dates, before I start pushing CTL files out to phones? If I do this, do I need to restart the CM service?</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">Thanks !</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#888888"> </span></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#888888"> </span></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#888888">--
<br>
Ed Leatherman</span></p>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black"><br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black"><br>
<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a></span></p>
</div>
</div>
</div></body></html>