<div dir="ltr">I could see that happening. I'm wondering what about the certificate that Certificate Change Notification service thinks it's different.<div><br></div><div>This also means that no one ever actually tested this feature at all on a live cluster with phones as part of the testing process.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 9, 2014 at 2:41 PM, Matthew Loraditch <span dir="ltr"><<a href="mailto:MLoraditch@heliontechnologies.com" target="_blank">MLoraditch@heliontechnologies.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Yes this is the bug, it is super fun… Migrated to a customer to 10.5 and updated the certs.. spent a day finding out this was the bug.. I am eagerly awaiting
SU1.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Something to do with the sever being on multiple servers it continuously sends the cert to the other servers which causes the change notification.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Matthew G. Loraditch – CCNP-Voice, CCNA-R&S, CCDA<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#1f497d">1965 Greenspring Drive</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><br>
</span><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#1f497d">Timonium, MD 21093</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><br>
</span><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#1f497d"><br>
direct voice. <a href="tel:443.541.1518" value="+14435411518" target="_blank">443.541.1518</a><br>
fax. <a href="tel:410.252.9284" value="+14102529284" target="_blank">410.252.9284</a><br>
<br>
<a href="http://twitter.com/heliontech" target="_blank">Twitter</a> | <a href="http://www.facebook.com/#!/pages/Helion/252157915296" target="_blank">
Facebook</a> | <a href="http://www.heliontechnologies.com/" target="_blank">Website</a> | <a href="mailto:support@heliontechnologies.com?subject=Technical%20Support%20Request" target="_blank">
Email Support</a><u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#1f497d">Support Phone. <a href="tel:410.252.8830" value="+14102528830" target="_blank">410.252.8830</a></span><span style="font-size:11.0pt;font-family:"Arial","sans-serif";color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> cisco-voip [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>]
<b>On Behalf Of </b>Brian Meade<br>
<b>Sent:</b> Thursday, October 09, 2014 2:32 PM<br>
<b>To:</b> Jason Aarons (AM)<br>
<b>Cc:</b> cisco-voip (<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>)<br>
<b>Subject:</b> Re: [cisco-voip] Bug with mult-server certificate and phones reset every 7 min?<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">That's what it looks like. Starting in CUCM version 8.6, we started resetting all registered phones on the cluster whenever a certificate used in the ITL changed. This was to prevent the ITL from changing too much at once before the phones
go the update such as regenerating CallManager.pem and TVS.pem at the same time which will force you to have to delete the ITL on all phones unless the phones got the updated ITL after the first certificate was regenerated.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">It sounds like this bug is due to that behavior but I'm not sure why it repeats every 7 minutes. I would expect it to only happen the single time when the certificate database is updated.<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Thu, Oct 9, 2014 at 1:52 PM, Jason Aarons (AM) <<a href="mailto:jason.aarons@dimensiondata.com" target="_blank">jason.aarons@dimensiondata.com</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><a href="https://tools.cisco.com/bugsearch/bug/CSCup28852" target="_blank">https://tools.cisco.com/bugsearch/bug/CSCup28852</a><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">The way I read this (it’s not in a fixed version of CallManager yet) is that after you Upload Certificate a multi-server certificate you have to stop the Cisco Certificate Change
Notification (CCMServe > Tools > network Services > Cisoc Certificate Change Notification.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">If you don’t do this then the phones will reset every 7 minutes? Am I right in reading the bug?<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div></div></div>
</div>
</blockquote></div><br></div>