<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Lucida Grande";
panose-1:2 11 6 0 4 5 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-AU" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Is it time to start getting our EC certs signed as well?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">cisco-voip <cisco-voip-bounces@puck.nether.net> on behalf of "cisco-voip@puck.nether.net" <cisco-voip@puck.nether.net><br>
<b>Reply to: </b>"Ryan Ratliff (rratliff)" <rratliff@cisco.com><br>
<b>Date: </b>Wednesday, 4 September 2019 at 1:02 pm<br>
<b>To: </b>Anthony Holloway <avholloway+cisco-voip@gmail.com>, "cisco-voip@puck.nether.net" <cisco-voip@puck.nether.net><br>
<b>Subject: </b>Re: [cisco-voip] CUCM 11.5(1)SU6, Port 6972 and EC Certs<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">TCP/6972 is hosted by the TFTP service specifically for secure download of configuration files and firmware (HTTPS using the Callmanager-EC cert) by endpoints. It’s using EC because only endpoints that support strong encryption will use
support HTTPS downloads via TFTP.<o:p></o:p></p>
<p class="MsoNormal">TCP/6970 is for the same as HTTP<o:p></o:p></p>
<p class="MsoNormal">TCP/6971 is for the same as HTTPS using the Tomcat certificate (for Jabber)<o:p></o:p></p>
<p class="MsoNormal"><br>
None of these are intended to be used by your browser, though it works perfectly well for testing and troubleshooting.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Ryan Ratliff</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Manager, Cisco Cloud Collaboration TAC </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Standard Business Hours: 8:00AM-5:00PM EDT<br>
Email: rratliff@cisco.com</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Office: +1 919-476-2081</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Mobile: +1-919-225-0448</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Lucida Grande",sans-serif;color:black">Cisco U.S. Contact Numbers: +1-800-553-2447 or +1-408-526-7209</span><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">cisco-voip <cisco-voip-bounces@puck.nether.net> on behalf of Anthony Holloway <avholloway+cisco-voip@gmail.com><br>
<b>Date: </b>Tuesday, September 3, 2019 at 10:03 PM<br>
<b>To: </b>cisco-voip list <cisco-voip@puck.nether.net><br>
<b>Subject: </b>[cisco-voip] CUCM 11.5(1)SU6, Port 6972 and EC Certs</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">So, I just ran into something interesting where someone else took care of the certs for a CUCM I now have access to, and while the main CCMAdmin pages load fine in my browser with a full chain of trust, the 6972 page(s) are being delivered
as EC certs, which were not signed, and thus, I get a warning in my browser. <o:p>
</o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Now, I have other CUCM deployments under my belt where the Tomcat RSA certs are signed and EC not, because the default setting for CUCM is to not use EC certs until you tell it to. These deployments still present the RSA cert to me for
6972.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">The only difference is the SU6 part.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I couldn't find anything in the release notes nor in the bug search, and so I'm wondering if any of you know what might be happening.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I tried toggling the HTTP Ciphers from RSA only to All and back again, but that didn't work.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I tried re-uploading the RSA cert chain, starting from root, and then back through the 2 intermediates (yes, three layers deep, it's a public CA chain).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I've restarted Tomcat, I've deactivated/reactivate TFTP, I've rebooted the cluster, and I'm just at a loss. It's not that big of a deal, it just bothers me that I don't know why it's doing this.<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>