<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
See below.
<div class=""><br class="">
<div class="">
<div style="color: rgb(0, 0, 0); font-family: "Lucida Grande"; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
- Ryan Ratliff</div>
</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">On Mar 7, 2019, at 7:36 PM, Gr ccie <<a href="mailto:grccie@gmail.com" class="">grccie@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="auto" class="">Hi Ryan,
<div class=""><br class="">
</div>
<div class="">Sorry few more queries on ctl. Since the cluster is in non-secure mode (but has CTL due to historically being in mixed mode) and my main aim is to convert it to tokenless and keep ctl updated:</div>
<div class=""><br class="">
</div>
<div class="">1) I think we don’t even need to convert cluster to mixed mode for updating the CTLs. I checked in lab and was able to run update ctl command in non-secure mode and updated ctl is pushed to phone (although had to reset it, it didn’t do with service
restarts). Do you think there can be any complication if I just update the CTL without turning mixed on and then having to turn it off. As I save time/effort on that and its less risky as cluster is still in non-secure mode. </div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>No complications, though if you have a CTL there is no downside I can think of to being mixed mode. You don’t have to set encrypted profiles anywhere, though it’s nice to have that option. </div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div dir="auto" class="">
<div class="">2) Second question is just to confirm even if the hardware token expires - the ctl file still remains valid and we can still go tokenless regardless of the hardware token expiry as long as certs signing ctl are not changed. Does CTL file have
any expiry (apart from certs)? </div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Correct, the CTL itself does not expire, only the certificate that signed it.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div dir="auto" class="">
<div class=""><br class="">
</div>
<div class="">3) Also can I check hardware token expiry from cli? For example if I had lost a CTL token can I tell from any command output - when the ctl tokens will expire</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>You can check it with the CLI (db query, maybe show cert) and in OS Admin via Certificate Management. The eToken certs are in the database and trust-store.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div dir="auto" class="">
<div class=""><br class="">
<div dir="ltr" class="">Thank You</div>
<div dir="ltr" class=""><br class="">
On 27 Feb 2019, at 7:33 am, Ryan Ratliff (rratliff) <<a href="mailto:rratliff@cisco.com" class="">rratliff@cisco.com</a>> wrote:<br class="">
<br class="">
</div>
<blockquote type="cite" class="">
<div dir="ltr" class="">Inline.
<div class=""><br class="">
<div class="">
<div style="font-family: "Lucida Grande"; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
- Ryan Ratliff</div>
</div>
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">On Feb 26, 2019, at 7:39 AM, Gr ccie <<a href="mailto:grccie@gmail.com" class="">grccie@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">Hi Team,<br class="">
<br class="">
Cucm cluster 11 was in secure mode once (using hw tokens) - then changed back to non-secure mode. The servers and phones both have the CTL files.
<br class="">
<br class="">
1) What issues can we run into if the hardware tokens expire? (Server has itl and ctl both)<br class="">
Will the phones keep trusting files when it has both ITL AND CTL, based on ITL even if the CTL is corrupt or expired.
<br class="">
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">If they expire your chance to update them with anything besides CTLRecovery is gone.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">2) Any real benefit of updating the CTLs using the software CTL tokens by changing to secure mode and then again turn off secure mode?<br class="">
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">Only to avoid the case where your eTokens expire. It shifts this risk to when the cert that signed the CTL (publisher CallManager.pem) expires instead.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">3) Would it be a good idea to delete the CTL files from the server and phones if we don’t want mixed mode? How can we do it, we can delete the CTL from cli but how abt the phones - can we remove ctl by another method apart from the third party
tools like phone view?<br class="">
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">Yes, if you really want to make it look like mixed-mode never happened then you have to delete the CTL file everywhere, including at the phones. You are looking at automation via some 3rd party tool to do this.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">I believe LSC (being used for dot1x) would continue to operate by getting CAPF info from ITL.
<br class="">
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
Correct, the CAPF cert is in both ITL and CTL so as long as the ITL remains current you won’t have an issue obtaining LSCs.<br class="">
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">3) I need to regenerate the certificates as well on this cluster (capf/callmanager/tvs) - will it matter to have an updated CTL or expired?<br class="">
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">This depends on the phones. There was a bug at one point with 78xx/88xx where they would invalidate their good ITL at boot because the cert that signed it wasn’t in the CTL. If your firmware version is up to date you won’t be exposed to that but.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">4) Another unrelated question if we push a blank ITL file (enabling cluster rollback feature) and then update CTL in a secure CUCM (not something I would do but asking for sake of clarity) will it still trust the updated CTL file based on blank
ITL? <br class="">
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">Empty ITL is still signed, it just doesn’t have a TFTP or CCM+TFTP role in it, so the phone doesn’t look for signed files from TFTP. Accepting that ITL is still subject to validation of the cert that signed it against the certs in the current
trust store (CTL + ITL).</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class=""><br class="">
Thanks,<br class="">
GR<br class="">
_______________________________________________<br class="">
cisco-voip mailing list<br class="">
<a href="mailto:cisco-voip@puck.nether.net" class="">cisco-voip@puck.nether.net</a><br class="">
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" class="">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>