<div dir="ltr">Thanks for the follow up to this original thread:<div><br></div><div><a href="http://cisco-voip.markmail.org/thread/u37mdgcoaizjmyzj">http://cisco-voip.markmail.org/thread/u37mdgcoaizjmyzj</a><br></div><div><br></div><div>Was there a defect ID given to you, or at least an understanding of how it happened?</div></div><br><div class="gmail_quote"><div dir="ltr">On Mon, Jun 12, 2017 at 9:08 AM Gary Parker <<a href="mailto:G.J.Parker@lboro.ac.uk">G.J.Parker@lboro.ac.uk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Afternoon all, I finally got to the bottom of my SSL cert chain woes this morning so I thought I’d update you all and close the thread as I received so many helpful responses during my debugging. Also, apologies for cross-posting!<br>
<br>
Quick recap:<br>
Following a complicated roll-back and upgrade of our CUCM cluster with installation of fresh CA certs, the pub and 4x subs where all presenting a lone server cert to SSL connections on port 443 where they should have been presenting a minimum of intermediate and server. Jabber and other clients connecting to port 443 flagged an invalid certificate as they couldn’t create a full chain from server to root without the intermediate. Our support provider and TAC initially argued this was expected behaviour and suggested I manually, or via group policy, install the intermediate certificate on all client machines or else advise users to accept the invalid certificate(!). I rejected this assertion along with SSL documentation and feedback from these mailing lists showing other sites’ server infrastructure presenting a full certificate chain.<br>
<br>
Solution:<br>
The case was eventually escalated to the BU, a DE got root on our CUCM nodes and established that the CA certs I’d installed had, for some reason, only gone into the trust store on each of the servers and not the key store. I thought it was odd that the same thing had happened on all five servers but, hey, be thankful for small mercies: at least it failed consistently! From a root console the following commands were executed:<br>
<br>
rm -rf /usr/local/platform/.security/tomcat/certs/tomcat.keystore<br>
<br>
openssl pkcs12 -export -name tomcat -in /usr/local/platform/.security/tomcat/certs/tomcat.pem -chain -CApath /usr/local/platform/.security/tomcat/trust-certs -inkey /usr/local/platform/.security/tomcat/keys/tomcat_priv.pem -out /usr/local/platform/.security/tomcat/certs/tomcat.keystore -password file:/usr/local/platform/.security/tomcat/keys/tomcat.passphrase<br>
<br>
chown certbase:ccmbase /usr/local/platform/.security/tomcat/certs/tomcat.keystore<br>
<br>
chmod 755 /usr/local/platform/.security/tomcat/certs/tomcat.keystore<br>
<br>
This basically deletes the existing tomcat keystore, exports the contents of the truststore to a new keystore, and sets the correct permissions on it. The tomcat service was restarted and running<br>
<br>
openssl s_client -showcerts -connect <server>:443<br>
<br>
…showed all three certificates in the presented chain. This had to be carried out on each of the five servers but our Jabber and RTMT clients are now connecting without issue.<br>
<br>
Thanks again for everyone’s assistance on this one, particularly in carrying out testing on your infrastructure and reporting your findings.<br>
<br>
---<br>
/-Gary Parker----------------------------------f--\<br>
| Unified Communications Service Manager |<br>
n Loughborough University, IT Services |<br>
| tel:<a href="tel:+44%201509%20635635" value="+441509635635" target="_blank">+441509635635</a> <a href="mailto:sip%3Agary@lboro.ac.uk" target="_blank">sip:gary@lboro.ac.uk</a> o<br>
| <a href="http://delphium.lboro.ac.uk/pubkey.txt" rel="noreferrer" target="_blank">http://delphium.lboro.ac.uk/pubkey.txt</a> |<br>
\r----------------------------------------------d-/<br>
<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" rel="noreferrer" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
</blockquote></div>