Jabber Verification - SSL Certificates UC Servers

[Raymond Kuntz]

Hello, I've been trying to take advantage of the new Multiserver Certificate feature available in 10.5.

I appreciate anyone who can recall a recent deployment if they can share what certs they purchased for Jabber connect without issuing a certificate warning.

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/rel_notes/10_5_1/CUCM_BK_CE15D2A0_00_cucm-release-notes-1051/CUCM_BK_CE15D2A0_00_cucm-release-notes-1051_chapter_01.html#CUCM_RF_SEC52373_00

My goal is to purchase the least amount of SSL certificates from a public CA (for CUCM, IMP, Unity Connection, Expressway-C & E, WebEx Meeting Server) while still ensuring any Jabber client in the environment does NOT ever prompt for a security warning, across any platform (iOS, Android, Windows, Mac). We intend to deploy MRA and employ vpn-less Jabber.

It's hard to explain clearly since I have multiple questions all related. I have a few concerns based on the documentation that Cisco has supplied regarding the Jabber certificate verification process and what is required -

http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-presence/116917-technote-certificate-00.html

and

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/10_5/CJAB_BK_D6497E98_00_deployment-installation-guide-ciscojabber/CJAB_BK_D6497E98_00_deployment-installation-guide-ciscojabber_chapter_01100.html

Both documents state I'll need an xmpp certificate in addition to the standard tomcat. I'm not fully convinced, do I actually need an xmpp cert, I don't recall ever needing it before in similar deployments, but I just can't say for sure. I thought I would only need xmpp for secure federation deployments?

1. Do I need an xmpp cert or would the tomcat certs be enough for Jabber to be happy?

2. If I do need it, what xmpp cert would it be, there are two options the cup-xmpp or the cup-xmpp-s2s? Documentation just says XMPP.

3. For the tomcat certificate for cucm and imp, does the multiserver cluster feature on cucm also include and cover the tomcat certs for the imp servers, since now they are considered more like subscribers in the cucm cluster, or do I need separate tomcat certs for imp servers as well with the feature allowing the imp nodes to share as well as the cucm nodes to share?

Basically I have it narrowed down to the following anticipating the certs I'll need, but I don't want to waste budget for certs I don't need. Based on the concerns and information above, would you say is this accurate?

Using the multiserver certificate feature -

A single tomcat cert for all CUCM & IMP

A single xmpp cert for all IMP

A single tomcat cert for all CUCXN

A single identity cert for VCS-E

A single identity cert for VCS-C

A single tomcat cert for WebEx

I appreciate anyone who can recall a recent deployment if they can share what certs they purchased for Jabber.

[Jeremy Guillory · Accepted solution]

Use Digicert and you can use 1 SAN certificate for every server!

Other CA's are not as lenient.  GoDaddy will not let you get multiple SAN certificates with the same FQDN, for instance and will not let you associate multiple CSR's to a single SAN certificate. If we could export and import private keys from UC appliances we could still use a single SAN cert for all servers but the key stores are locked down in most of them.

1&2 - The documentation only calls for an cup-xmpp cert and the tomcat cert.  I believe the xmpps2s certificate if for federation.  I have never tried MRA without the xmpp certificate so I cannot verify if it will work.

3 Tomcat cert for CUCM covers IM&P tomcat.  Be aware there is a bug with the multi server certificates in CUCM that cause phones to reregister every 7 minutes as the certificates are replicated from node to node (bug id  CSCup28852).

[Raymond Kuntz]

Wow that is exciting, I found what you were referring to from Digicert here https://www.digicert.com/unlimited-servers.htm.

They actually let you generate separate key pairs which is what we would need here as well I think. I'm going to give it a shot!

I appreciate the info on the bug as well, good catch.

Thanks so much for you help!

[Raymond Kuntz]

Hi Jeremy, just to follow up, I'm not having much success... it seems Digicert will let you generate separate duplicate certificates each with a unique csr and private key when you purchase the cert any pay for all the SAN names up front, however they also automatically include all the SAN names from the original ucc cert purchase on each certificate you generate. So while they let you change the Common Name, you cannot eliminate all the extra SAN names from the cert, and unfortunately that means the original csr doesn't match and the Cisco servers give the error "CSR SAN and Certificate SAN does not match" when I try to apply.

Does this mean the only way we can get all servers properly setup with certificates is to purchase separate certificates for each? Have you done it in the past using a single cert with all the SANs listed?

Thanks again for your help.

UPDATE - Actually the pricing isn't too far off anyway between getting one cert with all the names and separate UCC certs as needed. Only a few hundred bucks more, so it's not that big of a deal. Thanks again for pointing me in the right direction. Using their service with the multi-server certificate feature still cuts a lot of the costs.

[Jeremy Guillory]

The trick to this is to rekey the certificate for each server that you are uploading to.  The SAN's do not have to be identical as long as the required FQDN's and domains are included.  You can have a bunch of extra entries with no issues.  

Sorry for the delayed response.