<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">One option is to use the Pre-8.0 enterprise field. If you get all your phones registered correctly, ie using your publisher as TFTP, you can then disable (or enable?) that enterprise parameter which requires a reboot of the phones. Then,
you can update all your certs, itl/ctl files and the flip the pre-8.0 parameter.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Or something like that. IT’s what is typically done when you rebuild a cluster offline or move clusters.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We’ve used this in the past a number of times.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Lelio<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> cisco-voip <cisco-voip-bounces@puck.nether.net>
<b>On Behalf Of </b>Eric Pedersen<br>
<b>Sent:</b> Wednesday, June 10, 2020 1:32 PM<br>
<b>To:</b> cisco-voip (cisco-voip@puck.nether.net) <cisco-voip@puck.nether.net><br>
<b>Subject:</b> [cisco-voip] Wrong ITL cert on subscribers<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="MsoNormal" style="line-height:12.0pt;background:#FFEB9C"><b><span lang="EN-CA" style="font-size:10.0pt;color:black">CAUTION:</span></b><span lang="EN-CA" style="font-size:10.0pt;color:black"> This email originated from outside of the University of
Guelph. Do not click links or open attachments unless you recognize the sender and know the content is safe. If in doubt, forward suspicious emails to
<a href="mailto:IThelp@uoguelph.ca">IThelp@uoguelph.ca</a><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">We had to rebuild our CUCM 12.5 publisher. That part went ok, but now the subscribers have an ITLRecovery certificate that differs from the pub and are giving out an ITL file signed with that certificate. The publisher
has the old, correct certificate which is got with the restore, but it looks like the subscribers for some reason got the ITL cert that the publisher generated after the build but before the restore. Phones are fine if the publisher is their TFTP server but
reject the ITL file if a subscriber is their TFTP server.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">TAC is saying we need to regenerate the ITL recovery certificate and then the ITL file which sounds extremely risky. I can't see why this would be necessary since the publisher certificate is correct. Does anyone have
experience with an issue like this? Changing CUCM certificates always makes me nervous. My nightmare situation is that we would have to factory reset all the phones.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">Eric<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><br>
<br>
Bennett Jones is committed to mitigating the spread of COVID-19. We have transitioned to a remote work environment and continue to provide complete and uninterrupted service to our clients. Visit our COVID-19 Resource Centre (<a href="https://www.bennettjones.com/COVID-19">https://www.bennettjones.com/COVID-19</a>)
for timely legal updates. <br>
<br>
The contents of this message may contain confidential and/or privileged subject matter. If this message has been received in error, please contact the sender and delete all copies. Like other forms of communication, e-mail communications may be vulnerable to
interception by unauthorized parties. If you do not wish us to communicate with you by e-mail, please notify us at your earliest convenience. In the absence of such notification, your consent is assumed. Should you choose to allow us to communicate by e-mail,
we will not take any additional security measures (such as encryption) unless specifically requested.
<br>
<br>
If you no longer wish to receive commercial messages, you can unsubscribe by accessing this link:
<a href="http://www.bennettjones.com/unsubscribe">http://www.bennettjones.com/unsubscribe</a>
<o:p></o:p></span></p>
</div>
</body>
</html>