<div dir="ltr">I was originally testing in FireFox ESR 68 with this CUCM 11.5(1)SU6.<div><br></div><div>To take your suggestion, I used FireFox ESR 60 and IE 11 and it still happens.</div><div><br></div><div>In my CUCM 11.5(1)SU5, where this doesn't happen,I am using FireFox ESR 60 and IE 11 as well.</div><div><br></div><div>So there's two major differences then, the CUCM version and where we get our certificates from (different end customers).</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Sep 4, 2019 at 1:05 PM Ryan Ratliff (rratliff) <<a href="mailto:rratliff@cisco.com">rratliff@cisco.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_7546862180177721224WordSection1">
<p class="MsoNormal">Remember the cert presentation in a TLS setup happens after the server knows the client’s capabilities.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Try with a browser or ssl client that doesn’t support EC and see if you get the RSA cert.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Ryan Ratliff<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Manager, Cisco Cloud Collaboration TAC <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Standard Business Hours: 8:00AM-5:00PM EDT<br>
Email: <a href="mailto:rratliff@cisco.com" target="_blank">rratliff@cisco.com</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Office: +1 919-476-2081<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Mobile: +1-919-225-0448<u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Cisco U.S. Contact Numbers: +1-800-553-2447 or +1-408-526-7209</span><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">Brian Meade <<a href="mailto:bmeade90@vt.edu" target="_blank">bmeade90@vt.edu</a>><br>
<b>Date: </b>Wednesday, September 4, 2019 at 1:59 PM<br>
<b>To: </b>Anthony Holloway <<a href="mailto:avholloway%2Bcisco-voip@gmail.com" target="_blank">avholloway+cisco-voip@gmail.com</a>><br>
<b>Cc: </b>Tim Smith <<a href="mailto:tim.smith@enject.com.au" target="_blank">tim.smith@enject.com.au</a>>, Ryan Ratliff <<a href="mailto:rratliff@cisco.com" target="_blank">rratliff@cisco.com</a>>, cisco-voip list <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<b>Subject: </b>Re: [cisco-voip] CUCM 11.5(1)SU6, Port 6972 and EC Certs<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This was on an 11.5 cluster without that setting changed from default. I'm wondering if that setting doesn't potentially change it everywhere.<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Wed, Sep 4, 2019 at 12:18 PM Anthony Holloway <<a href="mailto:avholloway%2Bcisco-voip@gmail.com" target="_blank">avholloway+cisco-voip@gmail.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">So Brian, you (or someone) has then changed the HTTPS Ciphers Enterprise Parameter to use EC certs then? Because that's not the default setting.<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Wed, Sep 4, 2019 at 10:20 AM Brian Meade <<a href="mailto:bmeade90@vt.edu" target="_blank">bmeade90@vt.edu</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Some customers of mine with Linux environments connect to the CCMAdmin pages with the EC certs. It's definitely a good idea to get those signed.<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Tue, Sep 3, 2019 at 11:06 PM Tim Smith <<a href="mailto:tim.smith@enject.com.au" target="_blank">tim.smith@enject.com.au</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span lang="EN-AU">Is it time to start getting our EC certs signed as well?<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-AU"> <u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-AU"> <u></u><u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span lang="EN-AU" style="font-size:12pt;color:black">From:
</span></b><span lang="EN-AU" style="font-size:12pt;color:black">cisco-voip <<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>> on behalf of "<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>"
<<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<b>Reply to: </b>"Ryan Ratliff (rratliff)" <<a href="mailto:rratliff@cisco.com" target="_blank">rratliff@cisco.com</a>><br>
<b>Date: </b>Wednesday, 4 September 2019 at 1:02 pm<br>
<b>To: </b>Anthony Holloway <<a href="mailto:avholloway%2Bcisco-voip@gmail.com" target="_blank">avholloway+cisco-voip@gmail.com</a>>, "<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>" <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<b>Subject: </b>Re: [cisco-voip] CUCM 11.5(1)SU6, Port 6972 and EC Certs</span><span lang="EN-AU"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU"> <u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span lang="EN-AU">TCP/6972 is hosted by the TFTP service specifically for secure download of configuration files and firmware (HTTPS using the Callmanager-EC cert) by endpoints.
It’s using EC because only endpoints that support strong encryption will use support HTTPS downloads via TFTP.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-AU">TCP/6970 is for the same as HTTP<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-AU">TCP/6971 is for the same as HTTPS using the Tomcat certificate (for Jabber)<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-AU"><br>
None of these are intended to be used by your browser, though it works perfectly well for testing and troubleshooting.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-AU"> <u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-AU" style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Ryan Ratliff</span><span lang="EN-AU"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Manager, Cisco Cloud Collaboration TAC </span><span lang="EN-AU"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Standard Business Hours: 8:00AM-5:00PM EDT<br>
Email: <a href="mailto:rratliff@cisco.com" target="_blank">rratliff@cisco.com</a></span><span lang="EN-AU"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Office: +1 919-476-2081</span><span lang="EN-AU"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Mobile: +1-919-225-0448</span><span lang="EN-AU"><u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span lang="EN-AU" style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Cisco U.S. Contact Numbers: +1-800-553-2447 or +1-408-526-7209</span><span lang="EN-AU"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-AU"> <u></u><u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span lang="EN-AU" style="font-size:12pt;color:black">From:
</span></b><span lang="EN-AU" style="font-size:12pt;color:black">cisco-voip <<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>> on behalf of Anthony Holloway <<a href="mailto:avholloway%2Bcisco-voip@gmail.com" target="_blank">avholloway+cisco-voip@gmail.com</a>><br>
<b>Date: </b>Tuesday, September 3, 2019 at 10:03 PM<br>
<b>To: </b>cisco-voip list <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<b>Subject: </b>[cisco-voip] CUCM 11.5(1)SU6, Port 6972 and EC Certs</span><span lang="EN-AU"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU">So, I just ran into something interesting where someone else took care of the certs for a CUCM I now have access to, and while the main CCMAdmin pages load fine
in my browser with a full chain of trust, the 6972 page(s) are being delivered as EC certs, which were not signed, and thus, I get a warning in my browser.
<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-AU"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU">Now, I have other CUCM deployments under my belt where the Tomcat RSA certs are signed and EC not, because the default setting for CUCM is to not use EC certs
until you tell it to. These deployments still present the RSA cert to me for 6972.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU">The only difference is the SU6 part.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU">I couldn't find anything in the release notes nor in the bug search, and so I'm wondering if any of you know what might be happening.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU">I tried toggling the HTTP Ciphers from RSA only to All and back again, but that didn't work.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU">I tried re-uploading the RSA cert chain, starting from root, and then back through the 2 intermediates (yes, three layers deep, it's a public CA chain).<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-AU">I've restarted Tomcat, I've deactivated/reactivate TFTP, I've rebooted the cluster, and I'm just at a loss. It's not that big of a deal, it just bothers me that
I don't know why it's doing this.<u></u><u></u></span></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><u></u><u></u></p>
</blockquote>
</div>
</blockquote>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote></div>