<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:2123264522;
mso-list-template-ids:1641705568;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks – you outlined the issues as I suspected them.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I was thinking more about the admin gui for things like CIMC, and other non-client facing services. But again, the same issues apply.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hopefully they modify their model slightly for appliance based systems –or- the partners that are participating build a Let’s Encrypt option for the certificates
in their products. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">---<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Lelio Fulgenzi, B.A.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Senior Analyst, Network Infrastructure<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Computing and Communications Services (CCS)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">University of Guelph<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">519-824-4120 Ext 56354<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">lelio@uoguelph.ca<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">www.uoguelph.ca/ccs<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Room 037, Animal Science and Nutrition Building<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Guelph, Ontario, N1G 2W1<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Ryan Huff [mailto:ryanhuff@outlook.com]
<br>
<b>Sent:</b> Tuesday, September 26, 2017 10:24 AM<br>
<b>To:</b> Lelio Fulgenzi; voyp list, cisco-voip (cisco-voip@puck.nether.net)<br>
<b>Subject:</b> Re: let's encrypt for local admin gui pages<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div id="divtagdefaultwrapper">
<p><span style="font-family:"Calibri","sans-serif";color:black">Its theoretically possible to take the CUCM tomcat CSR and use it to get LE to sign a cert, then take the resulting cert and attempt to upload it to CUCM however; if it worked, LE only signs certificates
for 90 days. So if you did get it to work, you'd have to do it every 90 days (the built in LE package on other Linux distros have built in tools to auto manage the renewal process, but no way to do it with CUCM).<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">... but thats if the moon is blue and you have a winning lotto ticket. To even get to that point, would be a feat; let me explain.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">The way LE for Linux signs certs is to install local software on the web server that will do an automatic Internet based FQDN check (meaning it automatically looks up the FQDN from the perspective
of the Internet) during the signing request. Once it finds the domain, it queries for a specific item within the web path to verify that domain belongs to the same person that started the certification signing request (this isn't a lot different than the way
Google or GoDaddy does it). However, the CSR must exist in a specific location on the server you are trying to sign the cert for. Once all criteria is met, LE automatically creates a vaild SSL certificate for the web server that is signed for 90 days and installs
it on the web server.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">So in order to even try and get this to sign a cert for a CUCM CSR you'd have to;<o:p></o:p></span></p>
<ul type="disc">
<li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
<span style="font-family:"Calibri","sans-serif"">Create an Internet facing Linux web server that mimics all the network details of the CUCM server and try to get LE to sign the CUCM CSR on that web server (you'd take CUCM's CSR and upload it to the Linux Web
Server).<o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
<span style="font-family:"Calibri","sans-serif"">Extract the signed .pem from the web server and attempt to upload to CUCM as a tomcat (you'll also need to grab LE's root CA and upload it to the tomcat-trust)<o:p></o:p></span></li></ul>
<p><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">In theory it might work, but is a helluva effort for 90 days just to get free certs, then do it all over again. Now if you got it to work and had a good workflow every 90 days ... maybe not that
bad? The other thing to consider that I'm not sure about in CMR cases (thinking if you tried this on an Expressway Edge) is if Cisco Collab Cloud (i.e WebEx) would trust the CA.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Thanks,<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Ryan<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-family:"Calibri","sans-serif";color:black">
<hr size="2" width="98%" align="center">
</span></div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> cisco-voip <<a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a>>
on behalf of Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca">lelio@uoguelph.ca</a>><br>
<b>Sent:</b> Tuesday, September 26, 2017 10:00 AM<br>
<b>To:</b> voyp list, cisco-voip (<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a>)<br>
<b>Subject:</b> [cisco-voip] let's encrypt for local admin gui pages</span><span style="font-family:"Calibri","sans-serif";color:black">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> <o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">Has anyone been successful in deploying Let’s Encrypt certificates on appliance based gui’s? Seems like Let’s Encrypt is a cloud based service, which has proxy support, but it’s
still client based with short certificate periods.<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> <o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> <o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">---<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">Lelio Fulgenzi, B.A.<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">Senior Analyst, Network Infrastructure<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">Computing and Communications Services (CCS)<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">University of Guelph<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> <o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">519-824-4120 Ext 56354<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><a href="mailto:lelio@uoguelph.ca">lelio@uoguelph.ca</a><o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><a href="http://www.uoguelph.ca/ccs">www.uoguelph.ca/ccs</a><o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">Room 037, Animal Science and Nutrition Building<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">Guelph, Ontario, N1G 2W1<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> <o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>