Installation, updates & backup

Setting up the web certificate

Generate a CSR, upload the signed certificate and CA chain and activate it for all web interfaces.

EasyUC · Version 4.8.7

In EasyUC: Manager → SSL-Zertifikate

What it is for

By default the web interfaces (administration, end-user portal, agent workplace, Manager) present a self-signed certificate. Browsers and CUCM warn about it or refuse the connection. A certificate from your internal PKI or a public certificate authority resolves this.

EasyUC generates the private key (RSA 4096 bits) itself; it does not leave the cluster. You create a certificate signing request (CSR) from it, have it signed and upload certificate and CA chain. Importing an existing private key or a PFX file is not provided.

The certificate for the Teams SBC is separate and is managed per tenant in the admin interface.

Prerequisites

A login to the Manager.
The host name under which users and CUCM reach the appliance, with a matching DNS record.
A certificate authority that signs the request.
The certificates of the certificate authority (intermediate and root certificate) as files.

Step by step

Open the SSL-Zertifikate page in the Manager.
In the Certificate Signing Requests area, fill in the fields, at least Common Name (CN).
Under Additional SANs (optional, comma-separated), enter further host names and IP addresses.
Select Generate CSR.
Download the request from the list with Download CSR and have it signed by your certificate authority.
In the Certificates area, select Upload Certificate and choose the signed certificate (.pem, .crt, .cer or .der).
In the CA Certificates area, select Upload CA and upload the intermediate and root certificate.
In the Activate Certificate area, select the certificate under Certificate and the associated CA certificates under CA Certificates (optional).
Select Activate.
Reload the page and check the certificate in the browser.

Fields and options

Fields and options
Field / action	Meaning and use
Common Name (CN)	Mandatory. The host name of the appliance, for example `easyuc.example.com`.
Organization	Name of the organisation.
Country	Two-letter country code, for example `DE`.
State / Locality	State or province and city.
Email	Contact address.
Additional SANs	Further names and IP addresses, separated by commas. EasyUC detects by itself whether an entry is a DNS name or an IP address.
Filename (optional)	Name of the request. Without an entry it is assigned automatically.
Server Private Key	"Generated" or "Not generated". The key is created when the first request is generated.
Certificate	"Active certificate configured" or "Not configured (using self-signed)".
Active Certificate	Shows Subject, Issuer, Valid From, Valid To, Serial, SANs and the Certificate Chain.
Deactivate	Returns to the self-signed certificate after confirmation.
Chain Warnings	Notes after activation, for example when the chain is incomplete.

Check the result and troubleshoot

The SSL Certificate Status area shows "Active certificate configured" and, under Active Certificate, the data of your certificate. In the list it carries the mark Active.
The browser shows the new certificate without a warning when you open the admin interface.
Chain Warnings after activation: the chain is incomplete. Upload the missing CA certificates and activate again.
If the certificate cannot be activated, it does not match the key of the appliance. It must be issued for a request generated in EasyUC.
There is no automatic renewal for the web certificate. Repeat the steps request, signature, upload and activation in good time before expiry.
After a certificate change on CUCM or on the appliance, check the connections between the two systems.
The page has English labels.