Expressway and support for ACMEv2

[Michael.Heimann]

Hi,

It's nice that Expressway supports certification renewal with ACME / Let's encrypt. Sadly even the current 12.5.5 is still using ACMEv1. This is an old version and is being replaced with ACMEv2 since 2018.

I've just had an issue where ACMEv1 didn't work and it was due to let's encrypt disabling that protocol from time to time to raise awareness: 

https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430/3

Please Cisco, update the certbot included and use ACMEv2.

Thanks,

Michael

[Jaime Valencia]

This forum is not monitored by the product team, I suggest you engage your SE/AM for this matter.

[Joel Frye]

A workaround is covered in CSCvr82346.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346/?rfs=iqvred

[Roger Kallberg · Accepted solution]

To help someone else that might not, just like in my case, have all that much experience with REST POST.

I downloaded and installed Postman

And did these steps.

1. Do a GET with basic authentication that use admin user/pw to this url, https://<FQDN of the E expressway>/api/management/configuration/acmeproviders/
2. Look at the response and copy the uuid that you get back.
3. Do a POST with basic authentication that use admin user/pw to this url, https://<FQDN of the E expressway>/api/management/configuration/acmeproviders/uuid/<UUID copyed in step 2>, create a body in raw text format with this content url=https://acme-v02.api.letsencrypt.org/directory
4. Do another GET with basic authentication that use admin user/pw to this url, https://<FQDN of the E expressway>/api/management/configuration/acmeproviders/
5. The url in the response should be updated from url "https://acme-v01.api.letsencrypt.org/directory" to url "https://acme-v02.api.letsencrypt.org/directory"

Best of luck with this

[Mark Turpin]

---

@Roger Kallberg wrote:

To help someone else that might not, just like in my case, have all that much experience with REST POST.

Thanks Roger, your instructions were accurate and certainly more helpful than instructing one to ask their account manager. The instructions from Cisco in their video on the same topic, are not correct. They do not include the uuid in the URL which was causing me frustration for quite some time.

+5 to you.

[Roger Kallberg]

---

@Mark Turpin wrote:

Thanks Roger, your instructions were accurate and certainly more helpful than instructing one to ask their account manager. The instructions from Cisco in their video on the same topic, are not correct. They do not include the uuid in the URL which was causing me frustration for quite some time.

+5 to you.

---

Thanks you Mark, I'm certainly glad that it was useful for you. :)

[Roger Kallberg]

---

@Joel Frye wrote:

A workaround is covered in CSCvr82346.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346/?rfs=iqvred

---

Per release notes for X12.5.7 this should now be fixed.

https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/release_note/Cisco-Expressway-Release-Note-X12-5-7.pdf