<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
It's not only not recommended but UCM won't put an IP address in cert subject or SAN.
<div><br>
</div>
<div>For Jabber it's a matter of getting signed certs, getting the certs loaded onto the PC, and fixing System->Server values so UDS doesn't screw up things by giving IPs to the client (this may be only a concern with MRA).</div>
<div><br>
<div>
<div>-Ryan </div>
<br>
<div>
<div>On Oct 29, 2014, at 1:56 PM, Josh Warcop <<a href="mailto:josh@warcop.com">josh@warcop.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div>
<div>
<div>
<div style="font-family: Calibri,sans-serif; font-size: 11pt;">Not recommended approach. SSL future guidelines dictates that non approved TLDs in SAN names will no longer be supported. IP address and short names in SANs is a bandaid. The proper way to to change
the server name setting to the FQDN and ensure every device is getting proper DNS suffix and DNS servers.
<br>
<br>
The second problem is that Jabber doesn't just look at the tomcat. It also checks callmanager.pen which should also be signed by a valid CA using valid subject and alternate names.
<br>
<br>
Sent from my Windows Phone</div>
</div>
<div dir="ltr">
<hr>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">From:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:jason.aarons@dimensiondata.com">Jason Aarons (AM)</a></span><br>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Sent:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">10/29/2014 1:50 PM</span><br>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">To:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:cisco-voip@puck.nether.net">cisco-voip (cisco-voip@puck.nether.net)</a></span><br>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Subject:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">[cisco-voip] Callmanager TomCat</span><br>
<br>
</div>
<style>
<!--
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
span.x_MsoHyperlink
{color:#0563C1;
text-decoration:underline}
span.x_MsoHyperlinkFollowed
{color:#954F72;
text-decoration:underline}
span.x_EmailStyle17
{font-family:"Calibri",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-family:"Calibri",sans-serif}
div.x_WordSection1
{}
-->
</style>
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="x_WordSection1">
<p class="x_MsoNormal"><span style="color:#1F497D">Customer is asking if they can leave CallManager > CCMAdmin > Server > IP address and change the Tomcat Certificate to IP Address for Jabber for Windows client to be happy and not prompt an error first time
opening? Can you even do that in CUCM? So keep the ip address as the Subject Alternate Name?</span></p>
<div><span style="color:#1F497D"> </span><br class="webkit-block-placeholder">
</div>
<div><span style="color:#1F497D"> </span><br class="webkit-block-placeholder">
</div>
<div> <br class="webkit-block-placeholder">
</div>
</div>
</div>
</div>
<span><Mail Attachment.txt></span>_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
https://puck.nether.net/mailman/listinfo/cisco-voip<br>
</div>
</div>
<br>
</div>
</div>
</body>
</html>