<div dir="ltr">On 7.x as long as you're not on a mixed mode cluster, re-generate any certs to your hearts desire and just reboot the nodes to restart all services.<div><br></div><div>Sometimes I've seen the ipsec-trust not get updated automatically on the other nodes which may require some manual iuntervention.</div>
<div><br></div><div>You can check the Cluster Security Mode under System->Enterprise Parameters. 0 is on-secure. 1 is mixed-mode.</div><div><br></div><div>Brian</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Tue, Jul 1, 2014 at 12:04 PM, Corson, Teressa <span dir="ltr"><<a href="mailto:Teressa.Corson@doit.nh.gov" target="_blank">Teressa.Corson@doit.nh.gov</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Hi, I hope someone might be able to help me on this.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">I have a CUCM 7.1.5 cluster and several certificates are expiring tomorrow (</span>CAPF-trust, CallManager-trust, ipsec-trust, CAPF, CallManager, ipsec, tomcat). The latter
4 were self-signed and I was able to regenerate them to renew the expiration date. After doing that on both pub and one sub (the other sub doesn’t show them expiring), I restarted tomcat. I later noted that the CAPF-trust, CallManager-trust, ipsec-trust
certs now also have a new date equal to those I regenerated. The CAPF-trust and CallManager-trust actually show up on two new lines in the GUI; so the old cert is there and the new one is too.<u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From what I’m reading online, it appears that I still have other steps to complete in order to direct CUCM to use the new certs. This is where I need assistance. I read some steps online
that said “Run the CTL client and update CTL” but I do not know what that means. I downloaded the CTL Client plugin and, after finding an old 32-bit laptop, was able to install it there. Now, I’m not sure where to go from here.
<u></u><u></u></span></p>
<p class="MsoNormal">Our phones don’t use a secure mode as far as I can tell. Security Setup shows Security Mode = Non Secure and LSC = Not Installed. Trust List menu shows no CTL or ITL file installed, but it does say “Configuration (signed).”<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Am I headed down the right path? What should I be expecting from the CTL Client? Or is there something different that I need to do to have the CUCM use the new certs?<u></u><u></u></p>
<p class="MsoNormal"><br>
Thanks.<u></u><u></u></p>
<p class="MsoNormal"><br>
T.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Teressa Corson, CCNP, CCDA, CCNP-Voice<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">TSS VI, Operations<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Network Operations<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">State of NH, Department of Information Technology<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><a href="tel:603-223-5727" value="+16032235727" target="_blank">603-223-5727</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><a href="http://www.nh.gov/doit" target="_blank">www.nh.gov/doit</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Statement of Confidentiality: The contents of this message are confidential. Any unauthorized disclosure, reproduction, use or dissemination (either in whole or in part)
is prohibited. If you are not the intended recipient of this message, please notify the sender immediately and delete the message from your system.<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<br>_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
<br></blockquote></div><br></div>