<html><body>
<p><font size="2" face="sans-serif">Thanks Matt - I agree with your process description. </font><br>
<br>
<font size="2" face="sans-serif">CUCM has a capability to 'push' a certificate down to the Jabber clients. I confess I don't know enough about it - wondering if it is only required when the CUCM server certificate is 'self-signed'.</font><br>
<font size="2" face="sans-serif"><br>
Joe</font><br>
<br>
<img width="16" height="16" src="cid:1__=0ABBF49EDFD4CE968f9e8a93df938690@csc.com" border="0" alt="Inactive hide details for Matthew Loraditch ---03/19/2015 08:43:01 AM---I'm not sure that interpretation is a correct descripti"><font size="2" color="#424282" face="sans-serif">Matthew Loraditch ---03/19/2015 08:43:01 AM---I'm not sure that interpretation is a correct description of the process. All ssl certs indicate the</font><br>
<br>
<font size="1" color="#5F5F5F" face="sans-serif">From: </font><font size="1" face="sans-serif">Matthew Loraditch <MLoraditch@heliontechnologies.com></font><br>
<font size="1" color="#5F5F5F" face="sans-serif">To: </font><font size="1" face="sans-serif">Joe Loiacono/USA/CSC@CSC, "cisco-voip@puck.nether.net" <cisco-voip@puck.nether.net></font><br>
<font size="1" color="#5F5F5F" face="sans-serif">Date: </font><font size="1" face="sans-serif">03/19/2015 08:43 AM</font><br>
<font size="1" color="#5F5F5F" face="sans-serif">Subject: </font><font size="1" face="sans-serif">RE: [cisco-voip] Call Manager, Jabber, and Certificates</font><br>
<hr width="100%" size="2" align="left" noshade style="color:#8091A5; "><br>
<br>
<br>
<font size="2" color="#1F497D" face="Calibri">I’m not sure that interpretation is a correct description of the process. All ssl certs indicate their issuer. As long as your device trusts that issuer, it trusts certificates from that issuer.</font><br>
<font size="2" color="#1F497D" face="Calibri">For example if you go to </font><a href="https://www.cisco.com/"><font size="2" color="#0563C1" face="Calibri"><u>https://www.cisco.com</u></font></a><font size="2" color="#1F497D" face="Calibri"> and look at their cert on a window box you will see the certification path goes to a Baltimore CyberTrust root with is included in Windows built in trusted roots supplied by Microsoft.</font><br>
<font size="2" color="#1F497D" face="Calibri">Jabber works the same way it presents the various CUCM/IM&P/UCXN SSL certs to your PC and your PC verifies them against what it already trusts.</font><br>
<font size="2" color="#1F497D" face="Calibri"> </font><br>
<font size="2" color="#1F497D" face="Calibri">It’s not pushing anything by my understanding.</font><br>
<font size="2" color="#1F497D" face="Calibri"> </font><br>
<font size="2" color="#1F497D" face="Calibri"> </font><br>
<font size="2" color="#1F497D" face="Calibri">Matthew G. Loraditch – CCNP-Voice, CCNA-R&S, CCDA<br>
Network Engineer<br>
Direct Voice: 443.541.1518</font><font size="2" color="#1F497D" face="Calibri"><br>
</font><br>
<a href="https://www.facebook.com/heliontech?ref=hl"><font size="1" color="#0000FF" face="Calibri"><u>Facebook</u></font></a><font size="1" color="#1F497D" face="Calibri"> | </font><a href="https://twitter.com/HelionTech"><font size="1" color="#0000FF" face="Calibri"><u>Twitter</u></font></a><font size="1" color="#1F497D" face="Calibri"> | </font><a href="https://www.linkedin.com/company/helion-technologies?trk=top_nav_home"><font size="1" color="#0000FF" face="Calibri"><u>LinkedIn</u></font></a><font size="1" color="#1F497D" face="Calibri"> | </font><a href="https://plus.google.com/+Heliontechnologies/posts"><font size="1" color="#0000FF" face="Calibri"><u>G+</u></font></a><br>
<font size="2" color="#1F497D" face="Calibri"> </font><br>
<font size="2" face="Calibri"><b>From:</b></font><font size="2" face="Calibri"> cisco-voip [</font><font size="2" face="Calibri"><a href="mailto:cisco-voip-bounces@puck.nether.net">mailto:cisco-voip-bounces@puck.nether.net</a></font><font size="2" face="Calibri">] </font><font size="2" face="Calibri"><b>On Behalf Of </b></font><font size="2" face="Calibri">Joe Loiacono</font><font size="2" face="Calibri"><b><br>
Sent:</b></font><font size="2" face="Calibri"> Thursday, March 19, 2015 8:29 AM</font><font size="2" face="Calibri"><b><br>
To:</b></font><font size="2" face="Calibri"> cisco-voip@puck.nether.net</font><font size="2" face="Calibri"><b><br>
Subject:</b></font><font size="2" face="Calibri"> [cisco-voip] Call Manager, Jabber, and Certificates</font><br>
<font size="3" face="Times New Roman"> </font>
<p><font size="2" face="Arial">Jabber documentation indicates that the Certificate that the client may require and is 'pushed' from Call Manager is a 'root certificate' that directs the Client to a trusted source that will validate the server's (Call Manager hosts) offered certificate.</font><font size="3" face="Times New Roman"><br>
</font><font size="2" face="Arial"><br>
If the Call Manager certificate is from a public trusted Certificate Authority(CA), and that CA is in the Windows certificate store, can the Certificate 'push' be avoided altogether?</font><font size="3" face="Times New Roman"><br>
</font><font size="2" face="Arial"><br>
Thanks,<br>
<br>
Joe Loiacono</font>
<p></body></html>