<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:"\@MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">I’ve heard from my help desk that they had a few users report the prompt for accepting a cert. Unfortunately, they gathered zero details for me and just had the users accept the cert…<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Good to know it’s not just us though. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>From:</b> cisco-voip <cisco-voip-bounces@puck.nether.net>
<b>On Behalf Of </b>Jason Aarons<br>
<b>Sent:</b> Thursday, November 11, 2021 10:17 AM<br>
<b>To:</b> Gary Parker <G.J.Parker@lboro.ac.uk><br>
<b>Cc:</b> cisco-voip@puck.nether.net<br>
<b>Subject:</b> [External] Re: [cisco-voip] Jabber Users Prompted To Accept Webex Cert<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:black;background:white">Webex clients update switched from the Quovadis Root CA which was older and being retired, to the IdenTrust Root CA which it dates back to 2014.
The IdenTrust Root CA certificate is contained within the default trust store of all major operating systems by default.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:black;background:white"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:black;background:white">Not clear why IdenTrust is missing on your computers.
</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:black;background:white"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:black;background:white">Guessing maybe you disabled automatic root updates at some point or don’t have Windows updates running ?
<a href="https://serverfault.com/questions/752146/why-are-many-admins-using-turn-off-automatic-root-certificates-update-policy">
<span style="color:#0563C1">https://serverfault.com/questions/752146/why-are-many-admins-using-turn-off-automatic-root-certificates-update-policy</span></a></span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:black;background:white"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:black;background:white">Cisco Field Notice we didn’t notice</span><o:p></o:p></p>
<p class="MsoNormal"><a href="https://www.cisco.com/c/en/us/support/docs/field-notices/721/fn72120.html"><span style="color:#0563C1">https://www.cisco.com/c/en/us/support/docs/field-notices/721/fn72120.html</span></a><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Thu, Nov 11, 2021 at 6:22 AM Gary Parker <<a href="mailto:G.J.Parker@lboro.ac.uk">G.J.Parker@lboro.ac.uk</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">Morning all, a few years back we had a problem where lots of our managed Windows service users were complaining that their Jabber clients had started rejecting a certificate offered by
<a href="http://idbroker.webex.com" target="_blank">idbroker.webex.com</a><br>
<br>
This thread on <a href="http://community.cisco.com" target="_blank">community.cisco.com</a> (<a href="https://community.cisco.com/t5/unified-communications/jabber-idbroker-webex-com-certificate-request-during-the-first/td-p/3216376" target="_blank">https://community.cisco.com/t5/unified-communications/jabber-idbroker-webex-com-certificate-request-during-the-first/td-p/3216376</a>)
showed we weren’t the only ones, but that it seemed limited to managed clients.<br>
<br>
We solved this by adding the EXCLUDED_SERVICES=WEBEX flag to the installer on our managed clients.<br>
<br>
Fast forward to today and we suddenly have a load of service desk cases from users again. Nothing has changed in our configuration of Jabber client, IM&P servers or expressways. The clients haven’t been updated recently, and this time we’re also seeing the
“Certificate not valid” pop-up on unmanaged Windows machines as well as our managed service. The cert that’s being rejected has validity start date of late September, so it doesn’t appear to be a cert that’s only just been brought into use.<br>
<br>
Is anyone else seeing this today?<br>
<br>
As a workaround I’ve added:<br>
<br>
<ServiceDiscoveryExcludedServices>WEBEX</ServiceDiscoveryExcludedServices><br>
<br>
...to our jabber-config.xml, but that will require users to manually reset their clients. Not sure why I hadn’t done earlier ¯\_(<span style="font-family:"MS Gothic"">ツ</span>)_/¯
<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>