<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
There is the LSC and CTL files that do get transmitted from UCM to the Jabber client.
<div class=""><a href="http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/10_5/CJAB_BK_D6497E98_00_deployment-installation-guide-ciscojabber/CJAB_BK_D6497E98_00_deployment-installation-guide-ciscojabber_chapter_0110.html#JABW_RF_U3F30C79_00" class="">http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/10_5/CJAB_BK_D6497E98_00_deployment-installation-guide-ciscojabber/CJAB_BK_D6497E98_00_deployment-installation-guide-ciscojabber_chapter_0110.html#JABW_RF_U3F30C79_00</a></div>
<div class=""><br class="">
</div>
<div class="">The original sentence reads like a dumbed-down description of how trust chains work with any cert that UCM presents to Jabber during the establishing of a TLS session.</div>
<div class=""><br class="">
</div>
<div class="">If you aren’t doing encryption then just make sure the trust store on whatever platform Jabber is running on (Windows, Mac, etc) can validate the cert that UCM, IMP, etc will be presenting to it. </div>
<div class=""><br class="">
<div class="">-Ryan </div>
<br class="">
<div>
<div class="">On Mar 20, 2015, at 8:39 AM, Joe Loiacono <<a href="mailto:jloiacon@csc.com" class="">jloiacon@csc.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class=""><tt class=""><font size="2" class="">Rob Dawson <<a href="mailto:rdawson@force3.com" class="">rdawson@force3.com</a>> wrote on 03/19/2015 10:50:55 AM:<br class="">
<br class="">
> What document are you looking at?</font></tt> <br class="">
<br class="">
<tt class=""><font size="2" class="">Cisco Jabber for Windows 9.7 Installation and Configuration Guide</font></tt>
<br class="">
<br class="">
<tt class=""><font size="2" class="">> As far as I know the only certificate “push” would be done via GPO
<br class="">
> or some similar mechanism. During the SSL handshake the server <br class="">
> certificate is sent to the client and the client will attempt to <br class="">
> validate either the cert itself, or the signing authority, against <br class="">
> its trust list. If the certificate is not in the trust list then the<br class="">
> client will be offered the opportunity to trust/add it to its store,<br class="">
> but this is the server cert, not the root cert. If however the CA <br class="">
> root cert (public or private) OR the privately signed cert is <br class="">
> already in the trust list then it should work with no further <br class="">
> intervention or prompting. Once the client trusts the certificate <br class="">
> then the key exchange happens.</font></tt> <br class="">
<tt class=""><font size="2" class="">> I can’t really think of anytime that it would a solid decision,
<br class="">
> security wise, to allow a piece of software to install a trusted <br class="">
> root certificate.</font></tt> <br class="">
<br class="">
<br class="">
<tt class=""><font size="2" class="">I'm thinking the action that we take on CUCM, which we refer to as 'pushing a cert to the Jabber client' is the following:</font></tt>
<br class="">
<br class="">
<tt class=""><font size="2" class="">--------</font></tt> <br class="">
<br class="">
<tt class=""><font size="2" class="">Import Root Certificates on Client Computers</font></tt>
<br class="">
<br class="">
<tt class=""><font size="2" class="">Every server certificate should have an associated root certificate present in the trust store on client computers. Cisco Jabber validates the certificates that servers present against the root certificates in the trust
store. If you get server certificates signed by a public CA, the public CA should already have a root certificate present in the trust store on the client computer. In this case, you do not need to import root certificates on the client computers.</font></tt>
<br class="">
<br class="">
<tt class=""><font size="2" class="">You should import root certificates into the Microsoft Windows certificate store if:</font></tt>
<br class="">
<br class="">
<tt class=""><font size="2" class="">• The certificates are signed by a CA that does not already exist in the trust store, such as a private CA.</font></tt>
<br class="">
<br class="">
<tt class=""><font size="2" class="">Import the private CA certificate to the Trusted Root Certification Authorities store.</font></tt>
<br class="">
<br class="">
<tt class=""><font size="2" class="">• The certificates are self-signed.</font></tt>
<br class="">
<br class="">
<tt class=""><font size="2" class="">Import self-signed certificates to the Enterprise Trust store.</font></tt>
<br class="">
<br class="">
<tt class=""><font size="2" class="">--------</font></tt> <br class="">
<br class="">
<br class="">
<tt class=""><font size="2" class="">This is driving us nuts, so I'm wondering if we have self-signed server certs or we're using our own private CA, etc. I'm inquiring within, of course, just was curious what others had done here.</font></tt>
<br class="">
<br class="">
<tt class=""><font size="2" class="">Many thanks,</font></tt> <br class="">
<br class="">
<tt class=""><font size="2" class="">Joe </font></tt>_______________________________________________<br class="">
cisco-voip mailing list<br class="">
<a href="mailto:cisco-voip@puck.nether.net" class="">cisco-voip@puck.nether.net</a><br class="">
https://puck.nether.net/mailman/listinfo/cisco-voip<br class="">
</div>
</div>
<br class="">
</div>
</body>
</html>