"<span style="font-size:13.1999998092651px;line-height:19.7999992370605px">If you are using MRA, then the Expressway-E is the only entity the should require and external certificate."<br></span><br>To the best of my knowledge, if you have iPhone Jabber clients connecting via MRA, they will require public Trusted Root CA's.<br><div class="gmail_quote">On Thu Feb 05 2015 at 12:31:45 PM Heim, Dennis <<a href="mailto:Dennis.Heim@wwt.com">Dennis.Heim@wwt.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">For those windows clients you can run the following:<br>
<br>
certutil -verify -urlfetch <Path-to-CUPS-tomcat-cert.cer><br>
<br>
That should show why the certificate is failing validation. If you use an internal ca to sign your certs include the following subject alternative names:<br>
DNS:<FQDN><br>
DNS:<Hostname><br>
DNS:<IP-Address><br>
IP:<IP-Address><br>
<br>
I find that overkill usually helps certs validate.<br>
<br>
A few other things:<br>
-If using internal certificates, make sure that the AIA and CRL is published outside of Active Directory (aka via URL)<br>
-Make sure your template is supporting Server AND Client authentication.<br>
<br>
If you are using MRA, then the Expressway-E is the only entity the should require and external certificate.<br>
<br>
Hope this helps.<br>
<br>
<br>
<br>
Dennis Heim | Emerging Technology Architect (Collaboration)<br>
World Wide Technology, Inc. | +1 314-212-1814<br>
<br>
<br>
"Innovation happens on project squared" -- <a href="http://www.projectsquared.com" target="_blank">http://www.projectsquared.com</a><br>
<br>
<br>
-----Original Message-----<br>
From: cisco-voip [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@<u></u>puck.nether.net</a>] On Behalf Of Gary Parker<br>
Sent: Thursday, February 05, 2015 11:24 AM<br>
To: Cisco VoIP Group<br>
Subject: [cisco-voip] Recommendation For Certificate Provider For Jabber/Presence Use<br>
<br>
Hi folks, I’m in the process of replacing a load of self-signed certs on my 8.6.x CUCM, CUC and CUP servers.<br>
<br>
I’ve been having issues getting certs with the correct KeyUsage extensions from our current provider and wondered if anyone could recommend a company who can provide certificates that honour the requirements in the CSRs generated by the Cisco Unified Communications servers.<br>
<br>
I’m particularly interested in certificates that contain the "digitalSignature, nonRepudiation,<u></u>keyEncipherment,<u></u>dataEncipherment” extensions as per:<br>
<br>
<a href="http://blog.warcop.com/2015/01/22/cisco-jabber-certificate-warning-again/" target="_blank">http://blog.warcop.com/2015/<u></u>01/22/cisco-jabber-<u></u>certificate-warning-again/</a><br>
<br>
Jabber for Windows clients 9.2.5 and greater are flagging invalid certificates on our currently installed TERENA certificates.<br>
<br>
---<br>
/-Gary Parker------------------------<u></u>----------f--\<br>
| Unified Communications Service Manager |<br>
n Loughborough University IT Services |<br>
| Tel: +441509635635 Mob: +447989172258 o<br>
| <a href="http://delphium.lboro.ac.uk/pubkey.txt" target="_blank">http://delphium.lboro.ac.uk/<u></u>pubkey.txt</a> |<br>
\r----------------------------<u></u>------------------d-/<br>
<br>
<br>
______________________________<u></u>_________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/<u></u>mailman/listinfo/cisco-voip</a><br>
</blockquote></div>