<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
As I indicated, just signing TVS gets you nothing because the TVS cert will always be in the ITL. The gains come from the other certs TVS has to auth, and that
<b>those</b> certs are signed by the same CA.
<div>The real savings is just in the limited number of trust certs you have to upload. For multiple clusters it's probably just as easy to use the bulk cert upload feature.<br>
<div><br>
<div>-Ryan </div>
<br>
<div>
<div>On Aug 11, 2014, at 3:07 PM, Heim, Dennis <<a href="mailto:Dennis.Heim@wwt.com">Dennis.Heim@wwt.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div>
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Ryan:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D">I installed enterprise signed certificates (TVS) on both clusters. However, the usual issue between moving phones between clusters is still there. Apparently that idea does not work.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<div>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size: 10pt;">Dennis Heim | Collaboration Solutions Architect</span></b><span style=""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size: 10pt;">World Wide Technology, Inc. | +1 314-212-1814<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><a href="https://twitter.com/CollabSensei"><span style="color:blue;text-decoration:none"><image001.png></span></a><span style=""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><a href="xmpp:dennis.heim@wwt.com"><span style="color:#1F497D;text-decoration:none"><image002.png></span></a><a href="tel:+13142121814"><span style="color:#1F497D;text-decoration:none"><image003.png></span></a><a href="sip:dennis.heim@wwt.com"><span style="color:#1F497D;text-decoration:none"><image004.png></span></a><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style=""> </span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Ryan Ratliff (rratliff) [<a href="mailto:rratliff@cisco.com">mailto:rratliff@cisco.com</a>]
<br>
<b>Sent:</b> Monday, August 11, 2014 9:48 AM<br>
<b>To:</b> Heim, Dennis<br>
<b>Cc:</b> cisco-voip voyp list<br>
<b>Subject:</b> Re: [cisco-voip] TVS & Signed Certificates<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Yes, but not by nature of the TVS cert itself being CA-signed. Since the TVS cert will get into the ITL who signs it doesn't matter.
<span style="font-size:12.0pt"><o:p></o:p></span></p>
<div>
<p class="MsoNormal">Why it may help is because TVS will authorize any cert in the local server's trust store. If the other certs (the ones the endpoint presents to TVS) are CA-signed and TVS has the root cert available then in theory any cert signed by that
root cert will be authorized, regardless of whether the actual cert has been uploaded to UCM.
<o:p></o:p></p>
<div>
<p class="MsoNormal">This of course is an educated guess, and I'd thoroughly test it in the lab first.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">-Ryan <o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Aug 8, 2014, at 8:15 PM, Heim, Dennis <<a href="mailto:Dennis.Heim@wwt.com">Dennis.Heim@wwt.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">If you used signed certificates by your enterprise CA for TVS, would that allow TVS to validate across multiple clusters if both clusters TVS certificates were signed by the same CA?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I am trying to determine if there would ever be an advantage to doing a non-self signed certificate on the TVS.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:10.0pt">Dennis Heim | Collaboration Solutions Architect</span></b><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt">World Wide Technology, Inc. | +1 314-212-1814</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><a href="https://twitter.com/CollabSensei"><span style="color:blue;text-decoration:none"><image001.png></span></a><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><a href="xmpp:dennis.heim@wwt.com"><span style="color:windowtext;text-decoration:none"><image002.png></span></a><a href="tel:+13142121814"><span style="color:windowtext;text-decoration:none"><image003.png></span></a><a href="sip:dennis.heim@wwt.com"><span style="color:windowtext;text-decoration:none"><image004.png></span></a><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""> </span></p>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
</div>
</div>
</body>
</html>