Jose,<div><br></div><div>I just lab'd this up, with an internal CA (Win28kR2) and here are my cliff notes.</div><div><br></div><div>*most of the settings in this process can be left as default, or don't really matter, so long as you have a convention and it's used throughout.</div><div><br></div><div><span style="font-size:13.1999998092651px">Validate your UCCX DNS settings with show network eth0 detail. It should have a fully functioning DNS setup with A record and PTR record. A CNAME record is optional but nice if you want something like ccx.company.local instead of abc123ccx123.company.local (or other extreme hostname ugliness).</span><br></div><div><br></div><div>Validate your Web Security settings with show web-security. Set your SAN to the CNAME from the above paragraph like this:</div><div><br></div><div>set web-security <ouname> <oname> <city> <state> <country> ccx.company.local</div><div><br></div><div>This will regen the tomcat cert automatically, but as long as you don't restart Tomcat nor the server, no client will be served this cert. Optionally, if you want to see the cert on the client right now, just to see it, then restart Cisco Tomcat and/or Cisco Finesse Tomcat, then restart your browser to connect to the server again, and inspect the cert. Otherwise, leave it be for now, and let's move on.</div><div><br></div><div>I wont go through the details of enabling the MS AD Root CA role, but it's pretty self explanatory (I.e., Next, Next, Next, Next, etc.). It might even already be turned on in your environment. It will be required to proceed, so make sure it's done. Just be sure to adjust your group policy to allow auto enrollment of certs, otherwise, your Issuer cert will not be on the desktop PCs and the chain of trust will not exist. FireFox ignores this anyway, so you'll see need to address FF + Trusted Root CA, which can be <a href="http://www.cyberciti.biz/faq/firefox-adding-trusted-ca/">imported manually</a> into FF <a href="http://stackoverflow.com/questions/1435000/programmatically-install-certificate-into-mozilla">or automated</a>.</div><div><br></div><div>Alternatively, you could use some other server to sign your certs, and the only really difference I can think of is that you'd lack the auto enroll feature on the domain PC's, in which case you can simply right click the cert and import it into your trusted root CA. I'm sure there's even a way to push that out via GPO.</div><div><br></div><div>Now log into UCCX OS Admin and generate a new CSR for tomcat. Download that CSR and then point your browser to your AD CA like this:</div><div><br></div><div><a href="http://ad-ca.company.local/certsrv">http://ad-ca.company.local/certsrv</a></div><div><br></div><div>Go through the process of requesting a new cert with advanced settings from an existing file. You'll know you're at the right place if all it's asking you for is the contents of the CSR file. You'll need to copy/paste the contents into the browser window, select Web Server as the template, and then generate the cert. You will need to download the cer in order to upload it to UCCX, and then you'll need the Chain cert to import in to FF as well as upload to UCCX.</div><div><br></div><div>You should now have three files: a CSR (no longer needed), a new Cert (need to import to UCCX still), and a Chain cert (need to import into UCCX and FF).</div><div><br></div><div>Let's move on to uploading the chain and cert in UCCX, which is done in OS Admin. Upload the chain one first, then upload the tomcat one second. You will now need to restart Cisco Tomcat and Cisco Finesse Tomcat in order for them to start dishing out the new cert. You can do this from the CLI with utils service restart Cisco Tomcat and utils service restart Cisco Finesse Tomcat.</div><div><br></div><div>As long as you've auto enrolled your PC's in domain certs and/or imported the chain into FF, you should not see a warning any longer. If you did setup auto enroll, but the PC hasn't picked up the cert it needs yet, you can run gpupdate /force to make it happen without a logoff.</div><div><br></div><div>Recall that you can now use:</div><div><br></div><div><a href="https://ccx.company.loca/appadmin">https://ccx.company.loca/appadmin</a> AND <a href="https://ccx.company.local:8445/desktop">https://ccx.company.local:8445/desktop</a></div><div><br></div><div>That's a high level overview of using an internal CA to sign Tomcat and Finesse Tomcat. I hope it was helpful.</div><div><br><div class="gmail_quote">On Thu Feb 05 2015 at 12:17:54 PM Jose Colon II <<a href="mailto:jcolon424@gmail.com">jcolon424@gmail.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thanks Brian, How would I go about issuing a internal CA that does not require the Finesse user to accept multiple certificates. My users are not that tech savvy and there are over 300 of them that will need to come monday morning.</div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 5, 2015 at 11:38 AM, Kevin Przybylowski <span dir="ltr"><<a href="mailto:kevinp@advancedtsg.com" target="_blank">kevinp@advancedtsg.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Another nice CSR decoder: <a href="https://www.networking4all.com/en/support/tools/csr+check/" target="_blank">https://www.networking4all.com/en/support/tools/csr+check/</a><br>
<div><div><br>
<br>
-----Original Message-----<br>
From: cisco-voip [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>] On Behalf Of Jason Aarons (AM)<br>
Sent: Thursday, February 5, 2015 12:08 PM<br>
To: Gary Parker; <a href="mailto:jcolon424@gmail.com" target="_blank">jcolon424@gmail.com</a><br>
Cc: Cisco VOIP<br>
Subject: Re: [cisco-voip] 10.5.1 UCCX Certificate for Finesse<br>
<br>
I've run into this before TX vs Texas<br>
<br>
Use this to view your CSR and then fix via the set web-security commands etc<br>
<br>
<a href="http://certlogik.com/decoder/" target="_blank">http://certlogik.com/decoder/</a><br>
<br>
<br>
<br>
<br>
-----Original Message-----<br>
From: cisco-voip [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>] On Behalf Of Gary Parker<br>
Sent: Thursday, February 5, 2015 11:55 AM<br>
To: <a href="mailto:jcolon424@gmail.com" target="_blank">jcolon424@gmail.com</a><br>
Cc: Cisco VOIP<br>
Subject: Re: [cisco-voip] 10.5.1 UCCX Certificate for Finesse<br>
<br>
<br>
> On 5 Feb 2015, at 16:37, Jose Colon II <<a href="mailto:jcolon424@gmail.com" target="_blank">jcolon424@gmail.com</a>> wrote:<br>
><br>
> I am trying to generate certificate request from 10.5.1 UCCX box and the cert it generates is not working with verasign. It tells me "The State Name in the CSR cannot be abbreviated"<br>
><br>
> Anyone have any suggestions?<br>
<br>
Hi Jose, have a look at your CSR using:<br>
<br>
openssl req -text -noout -verify -in CSR.csr<br>
<br>
where CSR.csr is your csr file.<br>
<br>
Mine, for example, reads:<br>
<br>
Subject: C=GB, ST=Leicestershire, L=Loughborough, O=Loughborough University, OU=ITS, CN=<a href="http://tainter.lboro.ac.uk/serialNumber=xxxxxxxxxxxxxxxxxxxxxxxxx" target="_blank">tainter.lboro.ac.uk/serialNumber=xxxxxxxxxxxxxxxxxxxxxxxxx</a><br>
<br>
On the “Subject:” line is the entry for ST= an abbreviated version of your State name? If so I’d imagine you’ll have to login on the command line for the server and use “set web-security” to change the State to a proper value.<br>
<br>
If I had ST=Leics it would also likely fail.<br>
<br>
Be aware that this *may* make you have to relicense the server (I’m not sure if changing state is enough to trigger this).<br>
<br>
<br>
---<br>
/-Gary Parker----------------------------------f--\<br>
| Unified Communications Service Manager |<br>
n Loughborough University IT Services |<br>
| Tel: <a href="tel:%2B441509635635" value="+441509635635" target="_blank">+441509635635</a> Mob: <a href="tel:%2B447989172258" value="+447989172258" target="_blank">+447989172258</a> o<br>
| <a href="http://delphium.lboro.ac.uk/pubkey.txt" target="_blank">http://delphium.lboro.ac.uk/pubkey.txt</a> |<br>
\r----------------------------------------------d-/<br>
<br>
<br>
<br>
<br>
</div></div><div><div>_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
</div></div></blockquote></div><br></div>
______________________________<u></u>_________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/<u></u>mailman/listinfo/cisco-voip</a><br>
</blockquote></div></div>