Reviewing and accepting a CUCM certificate

What it is for

EasyUC signs in to AXL, to the real-time service (RIS) and to the voicemail server (Unity Connection) with a user name and password. To make sure these credentials reach only the correct server, EasyUC remembers the certificate per address and port on first contact: the SHA-256 fingerprint of the certificate and the fingerprint of the public key. This first read takes place without credentials.

For every further connection, EasyUC requires exactly this certificate before any data flows. If the server presents a different certificate, EasyUC aborts the connection and sends no credentials. After a certificate renewal on the CUCM this is the normal case, but it can also point to a foreign system.

For CUCM nodes, an administrator releases the new certificate in the interface: the node card on the dashboard then offers Accept new certificate. The dialog shows the stored and the current certificate side by side. The release applies to the node query and, if the AXL host presents the same certificate, also to the AXL and RIS access of the connection.

Prerequisites

• Sign-in as an administrator (ROLE_APP_ADMIN). Other roles do not see the button.
• License with the cucm module and access to the Dashboard (ROLE_APP_DASHBOARD).
• The affected CUCM connection is enabled and selected in the header.
• You know the fingerprint of the new certificate from a trusted source, for example from the certificate management of the CUCM (Cisco Unified OS Administration).
• The button appears only on nodes whose last query ended with a certificate error.

Step by step

1. In the header, select the EasyUC Cisco workspace and the affected CUCM connection.
2. In the menu, open Dashboard.
3. In the CUCM Information tile, find the card of the node with the message Certificate does not match.
4. On the card, click Accept new certificate. The Review certificate for … dialog opens and reads the current certificate from the node.
5. Under Current node certificate, compare the details Issued to, Issuer, Valid until and Certificate fingerprint (SHA-256) with the certificate in the CUCM. The Stored certificate is shown on the left for comparison.
6. Tick I have verified the fingerprint of the new certificate.
7. Click Accept new certificate.
8. The dialog closes. Below the tile, Certificate accepted. The status is being refreshed. appears. After the next query, the card shows measured values again.

Fields and options

Checking the result and narrowing down errors

• Success: the message Certificate accepted. The status is being refreshed., after which the node card shows CPU, memory and services again. The acceptance is recorded in the audit log.
• “This certificate is already stored. The TLS error has another cause.”: the certificate is unchanged. Check the reachability and address of the node.
• “The certificate or stored assignment has changed. Read the preview again and verify the fingerprint.”: click Read certificate again and compare again.
• “The certificate could not be read. Please try again.”: the node cannot be reached via TLS.
• “The certificate preview does not match the selected node. Please read it again.”: the preview belongs to another connection or another node. Close the dialog, check the connection in the header and open it again.
• The dialog closes by itself when you switch the CUCM connection in the header.
• For the certificate of the voicemail server, the interface has no button for acceptance. After a certificate change on Unity Connection, contact the operator of the appliance or support.