<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Digicert lets you put specific hosts into the SAN in addition to the wildcard. I haven't seen any other certificate provider with anything close to the flexibility
of Digicert. I haven't tried them on CUCM but they work perfectly on VCS, even for the connection to WebEx.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Eric<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> cisco-voip [mailto:cisco-voip-bounces@puck.nether.net]
<b>On Behalf Of </b>Norton, Mike<br>
<b>Sent:</b> 07 April 2016 5:13 PM<br>
<b>To:</b> cisco-voip@puck.nether.net; daniel@ohnesorge.me; jcolon424@gmail.com<br>
<b>Subject:</b> Re: [cisco-voip] Digicert Wildcard cert<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I use Digicert wildcard certs a lot for totally unrelated uses. Just did one yesterday. I have never seen them want to generate the private key for
me. That would be silly. If anyone other than me had the private key, then it wouldn’t be very private, would it? Maybe there is a way to have them generate the private key, but I can confirm it certainly isn’t mandatory.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">After submitting the CSR, before signing, they do allow you to change the CN to wildcard on their site.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">They do allow you to get multiple certs with the same wildcard CN using different keypairs. They call it “Get a duplicate” and it doesn’t cost anything
extra.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The only piece I’m not sure about is if they allow multiple SANs on a wildcard cert. Other than possibly that, I know the rest is doable.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Like I said, I am using them for non-UC stuff. If Cisco says they don’t support it then I’d be hesitant to do it even if it is doable.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">-mn<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"></a><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> cisco-voip [<a href="mailto:cisco-voip-bounces@puck.nether.net">mailto:cisco-voip-bounces@puck.nether.net</a>]
<b>On Behalf Of </b>Daniel Ohnesorge via cisco-voip<br>
<b>Sent:</b> April-07-16 4:18 PM<br>
<b>To:</b> <a href="mailto:ryanhuff@outlook.com">ryanhuff@outlook.com</a>; <a href="mailto:jcolon424@gmail.com">
jcolon424@gmail.com</a>; Cisco VOIP <<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a>><br>
<b>Cc:</b> Cisco VOIP <<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a>><br>
<b>Subject:</b> Re: [cisco-voip] Digicert Wildcard cert<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-CA">Jose,<o:p></o:p></span></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal"><span lang="EN-CA">A few things to know; most wildcard certs from Verisign, GoDaddy etc. generate a key pair (private and public key) for you and send you a passphrase protected .pfx or .p12 file which can then be imported to IIS, Apache
or any application (even Expressway for that matter). CUCM however does not allow private key import as it sees it a security risk and mandates that keys must be generated on CUCM via CSR. <o:p></o:p></span></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal"><span lang="EN-CA">The next thing to know is how CUCM deals with changes between its CSR and the certificate. The rule is that the Common Name of the CSR doesn't have to match but the SAN entries must match. So if you generate a Multi-SAN
certificate CSR, CUCM will automatically put all CUCM/CUPS nodes in the list and you/the CA are expected to ensure those entries match. Theoretically, the CA could change the Common Name to *.<a href="http://domain.com">domain.com</a>
during signing and you could actually import it in to CUCM. The challenge here is a) finding a CA which allows distinct individual keys/certs for the same wildcard Common Name and b) finding a CA that allows multiple SAN entries although the Common Name is
a wildcard.<o:p></o:p></span></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal"><span lang="EN-CA">You would be better off to work with the CA to refund the Wildcard certificate and swap it with a Multi-SAN product.<br>
<br>
Sent from my iPhone<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-CA"><br>
On 8 Apr 2016, at 07:34, Ryan Huff <<a href="mailto:ryanhuff@outlook.com">ryanhuff@outlook.com</a>> wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal"><span lang="EN-CA">As far as I am aware, true wildcard certificates (*.domain.tld) are not supported with UCOS (despite whether they work or not).<br>
<br>
Thanks, <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-CA">Ryan<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-CA"><br>
On Apr 7, 2016, at 5:30 PM, Jose Colon II <<a href="mailto:jcolon424@gmail.com">jcolon424@gmail.com</a>> wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal"><span lang="EN-CA">After reading the numerous posts saying that the wildcard certs would work I purchased the wild card cert. Just wondering how people got them to work.
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-CA">Thanks<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-CA">On Thu, Apr 7, 2016 at 4:24 PM, Ryan Huff <<a href="mailto:ryanhuff@outlook.com" target="_blank">ryanhuff@outlook.com</a>> wrote:<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<p class="MsoNormal"><span lang="EN-CA">Jose,<br>
<br>
I believe what you want are multi server (SAN) certificates for tomcat. You specify the distribution when generating the CSR.<br>
<br>
Thanks,<br>
<br>
Ryan<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-CA"><br>
> On Apr 7, 2016, at 5:21 PM, Jose Colon II <<a href="mailto:jcolon424@gmail.com">jcolon424@gmail.com</a>> wrote:<br>
><br>
> I have read a lot on forums that the digicert wildcard certs work great for UC apps as long as I am on 10.5 which I am.<br>
><br>
> Can someone lay out the process of uploading these certs as I am having a hard time with them. What format do I need them. What cert goes where etc.<br>
><br>
> Thanks in advance.<br>
><br>
> Jose<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-CA">> _______________________________________________<br>
> cisco-voip mailing list<br>
> <a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
> <a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><o:p></o:p></span></p>
</blockquote>
</div>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
</div>
</div>
</blockquote>
</div>
</blockquote>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-CA">_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><o:p></o:p></span></p>
</div>
</blockquote>
</div>
<br />
<br />
The contents of this message may contain confidential and/or privileged
subject matter. If this message has been received in error, please contact
the sender and delete all copies. Like other forms of communication,
e-mail communications may be vulnerable to interception by unauthorized
parties. If you do not wish us to communicate with you by e-mail, please
notify us at your earliest convenience. In the absence of such
notification, your consent is assumed. Should you choose to allow us to
communicate by e-mail, we will not take any additional security measures
(such as encryption) unless specifically requested.
<br />
<br />
If you no longer wish to receive commercial messages, you can unsubscribe
by accessing this link: http://www.bennettjones.com/unsubscribe
</body>
</html>