<div><div dir="auto">A couple of things:</div></div><div dir="auto"><br></div><div dir="auto">- Let’s Encrypt doesn’t require accessing the server from the Internet. (It supports a DNS based validation, too.)</div><div dir="auto">- As far as having port 80 exposed to CUCM - seems pretty safe. It doesn’t do anything but serve HTTPS redirects anyway. </div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Apr 5, 2020 at 11:45 Charles Goldsmith <<a href="mailto:w@woka.us">w@woka.us</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Last I looked, SSL certs can be had for 2 years, so agreed, not as good as 3, but still.<div><br></div><div>I'm a big fan of Let's Encrypt, but putting that on the inside of your network will be challenging, since that whole process has to be accessed from the internet for it to work. I do hope they solve it for CUCM, CUC and IM&P, but I don't see it happening anytime soon.</div><div><br></div><div>When you setup LE on the Expressway Edge, it has to be accessed by port 80 for them to validate it, no security engineer is going to let you do that to CUCM, unless they work up a method to do some other validation.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Apr 5, 2020 at 11:28 AM Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="auto">
Yeah. Considering how much effort we put on security, telling people to ignore cert warnings is probably not the best. It does take a bit more work. And it was ok with three year certs. Annual certs are going to make things a bit worse.
<div><br>
</div>
<div>Pushing self signed certs (or roots?) to devices will be an issue. And outside the scope of telephony. There are tools that can help. I believe JoinNow tool is one example. We use that and I believe my colleague got that working in a test environment. <br>
<div><br>
</div>
<div>I’m hoping they have an SU that introduces let’s encrypt for v11.5. 🤞🤞 <br>
<br>
<div id="m_-837053925454794269gmail-m_8255267638512167345AppleMailSignature" dir="ltr">Sent from my iPhone</div>
<div dir="ltr"><br>
On Apr 5, 2020, at 12:00 PM, Anthony Holloway <<a href="mailto:avholloway+cisco-voip@gmail.com" target="_blank">avholloway+cisco-voip@gmail.com</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr">Not to answer for Brian, but with the introduction of MRA, employees can run Jabber on any device they want. This makes putting private ca signed certs on those devices impossible or at least a giant headache.</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Sat, Apr 4, 2020 at 7:30 AM Mark H. Turpin <<a href="mailto:mturpin@covene.com" target="_blank">mturpin@covene.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>I’m using namecheap and have for years. Cheap certs from Comodo and they work fine. You can do email, web, and DNS validation -
<a href="https://www.namecheap.com/support/knowledgebase/article.aspx/9637/68/how-can-i-complete-the-domain-control-validation-dcv-for-my-ssl-certificate" target="_blank">
https://www.namecheap.com/support/knowledgebase/article.aspx/9637/68/how-can-i-complete-the-domain-control-validation-dcv-for-my-ssl-certificate</a><br>
<br>
Sorry, I missed the part on why you’re not using an internal CA for your internal servers though?<br>
<br>
--<br>
-Mark<br>
<hr style="display:inline-block;width:98%">
<div id="m_-837053925454794269gmail-m_8255267638512167345gmail-m_7508245048151285826divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> cisco-voip <<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>>
on behalf of Anthony Holloway <<a href="mailto:avholloway%2Bcisco-voip@gmail.com" target="_blank">avholloway+cisco-voip@gmail.com</a>><br>
<b>Sent:</b> Monday, March 30, 2020 9:58:12 PM<br>
<b>To:</b> UC Penguin <<a href="mailto:gentoo@ucpenguin.com" target="_blank">gentoo@ucpenguin.com</a>><br>
<b>Cc:</b> cisco-voip voyp list <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>>; Jonatan Quezada <<a href="mailto:jonatan.quezada@chemeketa.edu" target="_blank">jonatan.quezada@chemeketa.edu</a>>; Adrian Arevalo-Orozco
<<a href="mailto:adrian.arevalo.orozco@chemeketa.edu" target="_blank">adrian.arevalo.orozco@chemeketa.edu</a>><br>
<b>Subject:</b> Re: [cisco-voip] [EXTERNAL] Cost-Effective Public Certificate Authority for CUCM certificates</font>
<div> </div>
</div>
<div>*** EXTERNAL EMAIL - DO NOT CLICK LINKS *** <br>
<br>
<div>
<div dir="ltr">It's a good thing you don't have to prove ownership for collab certs then. I have not bought through namecheap myself, but I have witnessed the mistake someone has made trying to get domain validated, or EV certs for their collab gear when it's
not needed, and yeah, it seemed like a hassle and it took a few days or more.</div>
<br>
<div>
<div dir="ltr">On Mon, Mar 30, 2020 at 4:40 PM UC Penguin <<a href="mailto:gentoo@ucpenguin.com" target="_blank">gentoo@ucpenguin.com</a>> wrote:<br>
</div>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="auto">
<div dir="ltr">Namecheap cert process is a PITA. Haven’t used them for UC servers but helped a friend with their website after they already bought them from NC.</div>
<div dir="ltr"><span style="color:rgb(0,0,0)"><br>
</span></div>
<div dir="ltr"><span style="color:rgb(0,0,0)">You can only have it verify ownership with certain predefined by them emails at your domain, or dns/web.</span></div>
<div dir="ltr"><span style="color:rgb(0,0,0)"><br>
</span></div>
<div dir="ltr">Namecheap is a good domain registrar but I’d personally steer clear of their other services.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">
<blockquote type="cite">On Mar 30, 2020, at 14:57, Brian Meade <<a href="mailto:bmeade90@vt.edu" target="_blank">bmeade90@vt.edu</a>> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr">Namecheap seems to be the cheapest option I've found from some quick looking. They seem to resell Comodo certificates but cheaper than Comodo offers them.</div>
<br>
<div>
<div dir="ltr">On Mon, Mar 30, 2020 at 2:45 PM Jonatan Quezada <<a href="mailto:jonatan.quezada@chemeketa.edu" target="_blank">jonatan.quezada@chemeketa.edu</a>> wrote:<br>
</div>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">Im totally looking to update all of mine I think we use digi-cert, pleasea let us know what you find out :)
<div>Cheers!</div>
</div>
<br>
<div>
<div dir="ltr">On Mon, Mar 30, 2020 at 11:43 AM Brian Meade <<a href="mailto:bmeade90@vt.edu" target="_blank">bmeade90@vt.edu</a>> wrote:<br>
</div>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">Does anyone know of any public certificate authorities that have cheaper multi-server SAN certificate options? I had seen some in the past that let you buy a wildcard and then can submit CSR's against that still but having trouble finding that
now.
<div><br>
</div>
<div>Trying to avoid buying 4 multi-server certificates to cover CUCM Tomcat/Unity Connection Tomcat/UCCX Tomcat/IM&P XMPP.</div>
</div>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpuck.nether.net%2Fmailman%2Flistinfo%2Fcisco-voip&data=01%7C01%7Cmturpin%40covene.com%7C58b306e13bf84d8d65de08d7d51fd22a%7C575b0cc755204e999cb37affbf511f45%7C1&sdata=31dWW3cRzojiu8GNDZSHJbkachrakSZSm9SIDE2cljo%3D&reserved=0" rel="noreferrer" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div><font face="arial, helvetica, sans-serif">During this time of remote work, There will be the need for connectivity to other devices such as a cell phone. If you require assistance forwarding your desk phone to a remote cell or message phone, please email
with desk number and where we are forwarding calls. I can do these remotely.</font></div>
<div><br>
</div>
<div dir="ltr"><font face="arial, helvetica, sans-serif" size="4">Johnny Q</font></div>
<div dir="ltr"><span style="font-family:arial,helvetica,sans-serif;font-size:small">Voice Technology Analyst II</span></div>
<div dir="ltr"><span style="font-family:arial,helvetica,sans-serif;font-size:large">Chemeketa Community College</span><br>
</div>
<div dir="ltr">
<div><span style="font-size:12.8px"><a href="mailto:Johnny.Q@chemeketa.edu" target="_blank">Johnny.Q@chemeketa.edu</a></span></div>
<div><font size="1"><span style="font-family:arial,helvetica,sans-serif">Building 22 Room 130</span><br>
</font></div>
<div><font face="arial, helvetica, sans-serif" size="1">Work 5033995294 </font></div>
<div><font face="arial, helvetica, sans-serif" size="1">Cell 5035769873</font></div>
<div><span style="font-family:arial,helvetica,sans-serif;font-size:x-small">FAX 5033995549</span><br>
</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<span>_______________________________________________</span><br>
<span>cisco-voip mailing list</span><br>
<span><a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a></span><br>
<span><a href="https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpuck.nether.net%2Fmailman%2Flistinfo%2Fcisco-voip&data=01%7C01%7Cmturpin%40covene.com%7C58b306e13bf84d8d65de08d7d51fd22a%7C575b0cc755204e999cb37affbf511f45%7C1&sdata=31dWW3cRzojiu8GNDZSHJbkachrakSZSm9SIDE2cljo%3D&reserved=0" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a></span><br>
</div>
</blockquote>
</div>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpuck.nether.net%2Fmailman%2Flistinfo%2Fcisco-voip&data=01%7C01%7Cmturpin%40covene.com%7C58b306e13bf84d8d65de08d7d51fd22a%7C575b0cc755204e999cb37affbf511f45%7C1&sdata=31dWW3cRzojiu8GNDZSHJbkachrakSZSm9SIDE2cljo%3D&reserved=0" rel="noreferrer" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
<blockquote type="cite">
<div dir="ltr"><span>_______________________________________________</span><br>
<span>cisco-voip mailing list</span><br>
<span><a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a></span><br>
<span><a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a></span><br>
</div>
</blockquote>
</div>
</div>
</div>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" rel="noreferrer" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
</blockquote></div>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" rel="noreferrer" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
</blockquote></div></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><br>--<br>Hunter Fuller (they)<br>Router Jockey<br>VBH Annex B-5<br>+1 256 824 5331<br><br>Office of Information Technology<br>The University of Alabama in Huntsville<br>Network Engineering</div></div></div></div></div>