Mailing List Archive

This might be an unpopular opinion, but I think using the free certs
provided by let's encrypt, coupled with it being automatic from now on,
it's just an unbeatable combination.

Here are my cliff notes:

Reference Document:

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/exwy_b_certificate-creation-use-deployment-guide/exwy_b_certificate-creation-use-deployment-guide_chapter_0100.html



High Level Steps:

1. Expressway 12.5.7 to avoid ACMEv1 vs ACMEv2 registration issues (
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346)
2. For your Unified CM registrations domains don’t use parent domain
only (E.g., company.com), switch to CollabEdgeDNS format instead (E.g.,
collab-edge.company.com), because you’ll need that in the next step
3. DNS A records for the Expressway-E FQDN and the CM registration
domains
4. Upload the root and intermediates for Let’s Encrypt (needed on both
Expressway-E and Expressway-C) (certs are linked in documentation)
5. Enable the ACME client on Expressway-E and supply any email address
you want to link to this registration (This creates your account with Let’s
Encrypt)
6. Generate a new CSR (Server Certificate Only, Domain Cert Was Not
Needed)
7. Click button to Submit CSR to ACME
8. Click button to Deploy New Certificate on Expressway-E (documentation
states this is non-service impacting)
9. Setup the automatic scheduler so you never have to deal with this
again
10. Sit back, relax and enjoy free shit




On Fri, Apr 17, 2020 at 1:43 PM Riley, Sean <SRiley@robinsonbradshaw.com>
wrote:

> We had our Cisco partner setup our Expressways a couple of years ago. It
> is a cluster with 2 E’s and 2 C’s currently at v 12.5.7 using for MRA. I
> have been managing them, installing updates, troubleshooting etc. The
> public Edge cert is up for renewal. Can anyone provide advice on renewing
> this cert? I am planning on just renewing with the same cert provider, but
> was interested in if there is anything to watch out for. Example, will
> there be a service interruption when replacing the cert? Or just install
> the new cert/pk and rest easy?
>
>
>
> Thanks in advance.
>
>
>
> Sean.
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>

Great info Anthony, thanks.

Question, what do you do for Expressway Core if you don’t have an internal CA to sign the EXPC (meaning no internal root cert to upload to EXPE to establish the traversal zone trust)?

Sent from an iPhone mobile device with very tiny touchscreen input keys. Please excude my typtos.

> On Apr 17, 2020, at 3:25 PM, Anthony Holloway <avholloway+cisco-voip@gmail.com> wrote:
>
> ?
> This might be an unpopular opinion, but I think using the free certs provided by let's encrypt, coupled with it being automatic from now on, it's just an unbeatable combination.
>
> Here are my cliff notes:
>
> Reference Document:
> https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/exwy_b_certificate-creation-use-deployment-guide/exwy_b_certificate-creation-use-deployment-guide_chapter_0100.html
>
> High Level Steps:
> Expressway 12.5.7 to avoid ACMEv1 vs ACMEv2 registration issues (https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346)
> For your Unified CM registrations domains don’t use parent domain only (E.g., company.com), switch to CollabEdgeDNS format instead (E.g., collab-edge.company.com), because you’ll need that in the next step
> DNS A records for the Expressway-E FQDN and the CM registration domains
> Upload the root and intermediates for Let’s Encrypt (needed on both Expressway-E and Expressway-C) (certs are linked in documentation)
> Enable the ACME client on Expressway-E and supply any email address you want to link to this registration (This creates your account with Let’s Encrypt)
> Generate a new CSR (Server Certificate Only, Domain Cert Was Not Needed)
> Click button to Submit CSR to ACME
> Click button to Deploy New Certificate on Expressway-E (documentation states this is non-service impacting)
> Setup the automatic scheduler so you never have to deal with this again
> Sit back, relax and enjoy free shit
>
>
>
>> On Fri, Apr 17, 2020 at 1:43 PM Riley, Sean <SRiley@robinsonbradshaw.com> wrote:
>> We had our Cisco partner setup our Expressways a couple of years ago. It is a cluster with 2 E’s and 2 C’s currently at v 12.5.7 using for MRA. I have been managing them, installing updates, troubleshooting etc. The public Edge cert is up for renewal. Can anyone provide advice on renewing this cert? I am planning on just renewing with the same cert provider, but was interested in if there is anything to watch out for. Example, will there be a service interruption when replacing the cert? Or just install the new cert/pk and rest easy?
>>
>>
>>
>> Thanks in advance.
>>
>>
>>
>> Sean.
>>
>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voip@puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-voip
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip

Well, that depends. And let me just ask, why did they do it this way? If
it was even a self-signed cert, we could atleast import it to E, but it's
not even that. It's some invalid bogus cert in there. Why?

I have seen the following:

1. publicly sign it (name cheap has dirt cheap certs)
2. get a private ca installed because just like you need a network, a
server, licensing, phones, an internet connection, etc. it's apart of the
solution
3. sign it yourself with any ca you want to include the one running on your
home computer, and just don't tell anyone what you did because you setup it
for
34 years and it wont matter by then anyway (ok, just kidding here...or am
I?)

On Fri, Apr 17, 2020 at 3:55 PM Bill Talley <btalley@gmail.com> wrote:

> Great info Anthony, thanks.
>
> Question, what do you do for Expressway Core if you don’t have an internal
> CA to sign the EXPC (meaning no internal root cert to upload to EXPE to
> establish the traversal zone trust)?
>
> Sent from an iPhone mobile device with very tiny touchscreen input keys.
> Please excude my typtos.
>
> On Apr 17, 2020, at 3:25 PM, Anthony Holloway <
> avholloway+cisco-voip@gmail.com> wrote:
>
> ?
> This might be an unpopular opinion, but I think using the free certs
> provided by let's encrypt, coupled with it being automatic from now on,
> it's just an unbeatable combination.
>
> Here are my cliff notes:
>
> Reference Document:
>
>
> https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/exwy_b_certificate-creation-use-deployment-guide/exwy_b_certificate-creation-use-deployment-guide_chapter_0100.html
>
>
>
> High Level Steps:
>
> 1. Expressway 12.5.7 to avoid ACMEv1 vs ACMEv2 registration issues (
> https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346)
> 2. For your Unified CM registrations domains don’t use parent domain
> only (E.g., company.com), switch to CollabEdgeDNS format instead
> (E.g., collab-edge.company.com), because you’ll need that in the next
> step
> 3. DNS A records for the Expressway-E FQDN and the CM registration
> domains
> 4. Upload the root and intermediates for Let’s Encrypt (needed on both
> Expressway-E and Expressway-C) (certs are linked in documentation)
> 5. Enable the ACME client on Expressway-E and supply any email address
> you want to link to this registration (This creates your account with Let’s
> Encrypt)
> 6. Generate a new CSR (Server Certificate Only, Domain Cert Was Not
> Needed)
> 7. Click button to Submit CSR to ACME
> 8. Click button to Deploy New Certificate on Expressway-E
> (documentation states this is non-service impacting)
> 9. Setup the automatic scheduler so you never have to deal with this
> again
> 10. Sit back, relax and enjoy free shit
>
>
>
>
> On Fri, Apr 17, 2020 at 1:43 PM Riley, Sean <SRiley@robinsonbradshaw.com>
> wrote:
>
>> We had our Cisco partner setup our Expressways a couple of years ago. It
>> is a cluster with 2 E’s and 2 C’s currently at v 12.5.7 using for MRA. I
>> have been managing them, installing updates, troubleshooting etc. The
>> public Edge cert is up for renewal. Can anyone provide advice on renewing
>> this cert? I am planning on just renewing with the same cert provider, but
>> was interested in if there is anything to watch out for. Example, will
>> there be a service interruption when replacing the cert? Or just install
>> the new cert/pk and rest easy?
>>
>>
>>
>> Thanks in advance.
>>
>>
>>
>> Sean.
>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voip@puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>
>

Early on with MRA, back in the CUCM 9.1 days, a mobile user coming in
across MRA got cert alerts if you didn't have signed certs on all of the
applications (CUCM, IM&P, Unity Connection). There was/is no easy way to
push an internal CA cert to those devices.

That's the whole reason we push for 3rd party everywhere, so that the C
level folks on their smart phones didn't get an alert.

I'd really like to see let's encrypt enabled on all of the apps, but that
is challenging, updating certs every 90 days, restarting services, etc.
Plus, the whole thing of the Acme process needing to be available into the
application to validate.

On Fri, Apr 17, 2020 at 4:27 PM Anthony Holloway <
avholloway+cisco-voip@gmail.com> wrote:

> Well, that depends. And let me just ask, why did they do it this way? If
> it was even a self-signed cert, we could atleast import it to E, but it's
> not even that. It's some invalid bogus cert in there. Why?
>
> I have seen the following:
>
> 1. publicly sign it (name cheap has dirt cheap certs)
> 2. get a private ca installed because just like you need a network, a
> server, licensing, phones, an internet connection, etc. it's apart of the
> solution
> 3. sign it yourself with any ca you want to include the one running on
> your home computer, and just don't tell anyone what you did because you
> setup it for
> 34 years and it wont matter by then anyway (ok, just kidding here...or am
> I?)
>
> On Fri, Apr 17, 2020 at 3:55 PM Bill Talley <btalley@gmail.com> wrote:
>
>> Great info Anthony, thanks.
>>
>> Question, what do you do for Expressway Core if you don’t have an
>> internal CA to sign the EXPC (meaning no internal root cert to upload to
>> EXPE to establish the traversal zone trust)?
>>
>> Sent from an iPhone mobile device with very tiny touchscreen input keys.
>> Please excude my typtos.
>>
>> On Apr 17, 2020, at 3:25 PM, Anthony Holloway <
>> avholloway+cisco-voip@gmail.com> wrote:
>>
>> ?
>> This might be an unpopular opinion, but I think using the free certs
>> provided by let's encrypt, coupled with it being automatic from now on,
>> it's just an unbeatable combination.
>>
>> Here are my cliff notes:
>>
>> Reference Document:
>>
>>
>> https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/exwy_b_certificate-creation-use-deployment-guide/exwy_b_certificate-creation-use-deployment-guide_chapter_0100.html
>>
>>
>>
>> High Level Steps:
>>
>> 1. Expressway 12.5.7 to avoid ACMEv1 vs ACMEv2 registration issues (
>> https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346)
>> 2. For your Unified CM registrations domains don’t use parent domain
>> only (E.g., company.com), switch to CollabEdgeDNS format instead
>> (E.g., collab-edge.company.com), because you’ll need that in the next
>> step
>> 3. DNS A records for the Expressway-E FQDN and the CM registration
>> domains
>> 4. Upload the root and intermediates for Let’s Encrypt (needed on
>> both Expressway-E and Expressway-C) (certs are linked in documentation)
>> 5. Enable the ACME client on Expressway-E and supply any email
>> address you want to link to this registration (This creates your account
>> with Let’s Encrypt)
>> 6. Generate a new CSR (Server Certificate Only, Domain Cert Was Not
>> Needed)
>> 7. Click button to Submit CSR to ACME
>> 8. Click button to Deploy New Certificate on Expressway-E
>> (documentation states this is non-service impacting)
>> 9. Setup the automatic scheduler so you never have to deal with this
>> again
>> 10. Sit back, relax and enjoy free shit
>>
>>
>>
>>
>> On Fri, Apr 17, 2020 at 1:43 PM Riley, Sean <SRiley@robinsonbradshaw.com>
>> wrote:
>>
>>> We had our Cisco partner setup our Expressways a couple of years ago.
>>> It is a cluster with 2 E’s and 2 C’s currently at v 12.5.7 using for MRA.
>>> I have been managing them, installing updates, troubleshooting etc. The
>>> public Edge cert is up for renewal. Can anyone provide advice on renewing
>>> this cert? I am planning on just renewing with the same cert provider, but
>>> was interested in if there is anything to watch out for. Example, will
>>> there be a service interruption when replacing the cert? Or just install
>>> the new cert/pk and rest easy?
>>>
>>>
>>>
>>> Thanks in advance.
>>>
>>>
>>>
>>> Sean.
>>> _______________________________________________
>>> cisco-voip mailing list
>>> cisco-voip@puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>>
>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voip@puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>
>> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>

I agree with all of potential solutions. I’ve just come across a few isolated scenarios were we had to have the EXPC cert signed by a public CA since there were no alternatives (right, wrong or indifferent) and Let’s Encrypt isn’t available for the EXPC nodes (at least not using automated renewal).


Sent from an iPhone mobile device with very tiny touchscreen input keys. Please excude my typtos.

> On Apr 17, 2020, at 4:27 PM, Anthony Holloway <avholloway+cisco-voip@gmail.com> wrote:
>
> ?
> Well, that depends. And let me just ask, why did they do it this way? If it was even a self-signed cert, we could atleast import it to E, but it's not even that. It's some invalid bogus cert in there. Why?
>
> I have seen the following:
>
> 1. publicly sign it (name cheap has dirt cheap certs)
> 2. get a private ca installed because just like you need a network, a server, licensing, phones, an internet connection, etc. it's apart of the solution
> 3. sign it yourself with any ca you want to include the one running on your home computer, and just don't tell anyone what you did because you setup it for
> 34 years and it wont matter by then anyway (ok, just kidding here...or am I?)
>
>> On Fri, Apr 17, 2020 at 3:55 PM Bill Talley <btalley@gmail.com> wrote:
>> Great info Anthony, thanks.
>>
>> Question, what do you do for Expressway Core if you don’t have an internal CA to sign the EXPC (meaning no internal root cert to upload to EXPE to establish the traversal zone trust)?
>>
>> Sent from an iPhone mobile device with very tiny touchscreen input keys. Please excude my typtos.
>>
>>>> On Apr 17, 2020, at 3:25 PM, Anthony Holloway <avholloway+cisco-voip@gmail.com> wrote:
>>>>
>>> ?
>>> This might be an unpopular opinion, but I think using the free certs provided by let's encrypt, coupled with it being automatic from now on, it's just an unbeatable combination.
>>>
>>> Here are my cliff notes:
>>>
>>> Reference Document:
>>> https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/exwy_b_certificate-creation-use-deployment-guide/exwy_b_certificate-creation-use-deployment-guide_chapter_0100.html
>>>
>>> High Level Steps:
>>> Expressway 12.5.7 to avoid ACMEv1 vs ACMEv2 registration issues (https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346)
>>> For your Unified CM registrations domains don’t use parent domain only (E.g., company.com), switch to CollabEdgeDNS format instead (E.g., collab-edge.company.com), because you’ll need that in the next step
>>> DNS A records for the Expressway-E FQDN and the CM registration domains
>>> Upload the root and intermediates for Let’s Encrypt (needed on both Expressway-E and Expressway-C) (certs are linked in documentation)
>>> Enable the ACME client on Expressway-E and supply any email address you want to link to this registration (This creates your account with Let’s Encrypt)
>>> Generate a new CSR (Server Certificate Only, Domain Cert Was Not Needed)
>>> Click button to Submit CSR to ACME
>>> Click button to Deploy New Certificate on Expressway-E (documentation states this is non-service impacting)
>>> Setup the automatic scheduler so you never have to deal with this again
>>> Sit back, relax and enjoy free shit
>>>
>>>
>>>
>>>> On Fri, Apr 17, 2020 at 1:43 PM Riley, Sean <SRiley@robinsonbradshaw.com> wrote:
>>>> We had our Cisco partner setup our Expressways a couple of years ago. It is a cluster with 2 E’s and 2 C’s currently at v 12.5.7 using for MRA. I have been managing them, installing updates, troubleshooting etc. The public Edge cert is up for renewal. Can anyone provide advice on renewing this cert? I am planning on just renewing with the same cert provider, but was interested in if there is anything to watch out for. Example, will there be a service interruption when replacing the cert? Or just install the new cert/pk and rest easy?
>>>>
>>>>
>>>>
>>>> Thanks in advance.
>>>>
>>>>
>>>>
>>>> Sean.
>>>>
>>>> _______________________________________________
>>>> cisco-voip mailing list
>>>> cisco-voip@puck.nether.net
>>>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>> _______________________________________________
>>> cisco-voip mailing list
>>> cisco-voip@puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-voip

You Charles, with smart licensing being a catalyst for internet access for
your apps, and the way the port 80 thing for ACME actually works, it's
certainly possible, and I could see it gaining adoption with SMB....maybe
not the fortune 500 though. But then again, they can just spend the money
on public certs.

And also, you mentioned the challenge of updating certs every 90 days and
the service restarts, however, with the way Expressway implemented it, the
renewals are automatic and there is no service interruption at all.

On Fri, Apr 17, 2020 at 4:50 PM Charles Goldsmith <w@woka.us> wrote:

> Early on with MRA, back in the CUCM 9.1 days, a mobile user coming in
> across MRA got cert alerts if you didn't have signed certs on all of the
> applications (CUCM, IM&P, Unity Connection). There was/is no easy way to
> push an internal CA cert to those devices.
>
> That's the whole reason we push for 3rd party everywhere, so that the C
> level folks on their smart phones didn't get an alert.
>
> I'd really like to see let's encrypt enabled on all of the apps, but that
> is challenging, updating certs every 90 days, restarting services, etc.
> Plus, the whole thing of the Acme process needing to be available into the
> application to validate.
>
> On Fri, Apr 17, 2020 at 4:27 PM Anthony Holloway <
> avholloway+cisco-voip@gmail.com> wrote:
>
>> Well, that depends. And let me just ask, why did they do it this way?
>> If it was even a self-signed cert, we could atleast import it to E, but
>> it's not even that. It's some invalid bogus cert in there. Why?
>>
>> I have seen the following:
>>
>> 1. publicly sign it (name cheap has dirt cheap certs)
>> 2. get a private ca installed because just like you need a network, a
>> server, licensing, phones, an internet connection, etc. it's apart of the
>> solution
>> 3. sign it yourself with any ca you want to include the one running on
>> your home computer, and just don't tell anyone what you did because you
>> setup it for
>> 34 years and it wont matter by then anyway (ok, just kidding here...or
>> am I?)
>>
>> On Fri, Apr 17, 2020 at 3:55 PM Bill Talley <btalley@gmail.com> wrote:
>>
>>> Great info Anthony, thanks.
>>>
>>> Question, what do you do for Expressway Core if you don’t have an
>>> internal CA to sign the EXPC (meaning no internal root cert to upload to
>>> EXPE to establish the traversal zone trust)?
>>>
>>> Sent from an iPhone mobile device with very tiny touchscreen input
>>> keys. Please excude my typtos.
>>>
>>> On Apr 17, 2020, at 3:25 PM, Anthony Holloway <
>>> avholloway+cisco-voip@gmail.com> wrote:
>>>
>>> ?
>>> This might be an unpopular opinion, but I think using the free certs
>>> provided by let's encrypt, coupled with it being automatic from now on,
>>> it's just an unbeatable combination.
>>>
>>> Here are my cliff notes:
>>>
>>> Reference Document:
>>>
>>>
>>> https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/exwy_b_certificate-creation-use-deployment-guide/exwy_b_certificate-creation-use-deployment-guide_chapter_0100.html
>>>
>>>
>>>
>>> High Level Steps:
>>>
>>> 1. Expressway 12.5.7 to avoid ACMEv1 vs ACMEv2 registration issues (
>>> https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346)
>>> 2. For your Unified CM registrations domains don’t use parent domain
>>> only (E.g., company.com), switch to CollabEdgeDNS format instead
>>> (E.g., collab-edge.company.com), because you’ll need that in the
>>> next step
>>> 3. DNS A records for the Expressway-E FQDN and the CM registration
>>> domains
>>> 4. Upload the root and intermediates for Let’s Encrypt (needed on
>>> both Expressway-E and Expressway-C) (certs are linked in documentation)
>>> 5. Enable the ACME client on Expressway-E and supply any email
>>> address you want to link to this registration (This creates your account
>>> with Let’s Encrypt)
>>> 6. Generate a new CSR (Server Certificate Only, Domain Cert Was Not
>>> Needed)
>>> 7. Click button to Submit CSR to ACME
>>> 8. Click button to Deploy New Certificate on Expressway-E
>>> (documentation states this is non-service impacting)
>>> 9. Setup the automatic scheduler so you never have to deal with this
>>> again
>>> 10. Sit back, relax and enjoy free shit
>>>
>>>
>>>
>>>
>>> On Fri, Apr 17, 2020 at 1:43 PM Riley, Sean <SRiley@robinsonbradshaw.com>
>>> wrote:
>>>
>>>> We had our Cisco partner setup our Expressways a couple of years ago.
>>>> It is a cluster with 2 E’s and 2 C’s currently at v 12.5.7 using for MRA.
>>>> I have been managing them, installing updates, troubleshooting etc. The
>>>> public Edge cert is up for renewal. Can anyone provide advice on renewing
>>>> this cert? I am planning on just renewing with the same cert provider, but
>>>> was interested in if there is anything to watch out for. Example, will
>>>> there be a service interruption when replacing the cert? Or just install
>>>> the new cert/pk and rest easy?
>>>>
>>>>
>>>>
>>>> Thanks in advance.
>>>>
>>>>
>>>>
>>>> Sean.
>>>> _______________________________________________
>>>> cisco-voip mailing list
>>>> cisco-voip@puck.nether.net
>>>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>>>
>>> _______________________________________________
>>> cisco-voip mailing list
>>> cisco-voip@puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>>
>>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voip@puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>
>

Very true on the service interruption, but how about jabber, new certs on
it require the XMPP services to restart. And true, a satellite server
could alleviate it all, but you are talking major changes for the CUCM
team, and then the CUC team, etc.

I'd love for it to happen, but we have some hurdles, and I'm sure this has
been discussed amongst the developers and the BUs.

With Apple changing and advising certs for 1 year, I had a bigger customer
just tell me that they are adopting 1 year certs as the standard. I'm
about to renew their entire cluster of 18 nodes (across all of the apps)
for their certs, and they will be 1 year certs.

For a 24/7 operation, that's a pain, but, more work for us I guess.


On Fri, Apr 17, 2020 at 5:36 PM Anthony Holloway <
avholloway+cisco-voip@gmail.com> wrote:

> You Charles, with smart licensing being a catalyst for internet access for
> your apps, and the way the port 80 thing for ACME actually works, it's
> certainly possible, and I could see it gaining adoption with SMB....maybe
> not the fortune 500 though. But then again, they can just spend the money
> on public certs.
>
> And also, you mentioned the challenge of updating certs every 90 days and
> the service restarts, however, with the way Expressway implemented it, the
> renewals are automatic and there is no service interruption at all.
>
> On Fri, Apr 17, 2020 at 4:50 PM Charles Goldsmith <w@woka.us> wrote:
>
>> Early on with MRA, back in the CUCM 9.1 days, a mobile user coming in
>> across MRA got cert alerts if you didn't have signed certs on all of the
>> applications (CUCM, IM&P, Unity Connection). There was/is no easy way to
>> push an internal CA cert to those devices.
>>
>> That's the whole reason we push for 3rd party everywhere, so that the C
>> level folks on their smart phones didn't get an alert.
>>
>> I'd really like to see let's encrypt enabled on all of the apps, but that
>> is challenging, updating certs every 90 days, restarting services, etc.
>> Plus, the whole thing of the Acme process needing to be available into the
>> application to validate.
>>
>> On Fri, Apr 17, 2020 at 4:27 PM Anthony Holloway <
>> avholloway+cisco-voip@gmail.com> wrote:
>>
>>> Well, that depends. And let me just ask, why did they do it this way?
>>> If it was even a self-signed cert, we could atleast import it to E, but
>>> it's not even that. It's some invalid bogus cert in there. Why?
>>>
>>> I have seen the following:
>>>
>>> 1. publicly sign it (name cheap has dirt cheap certs)
>>> 2. get a private ca installed because just like you need a network, a
>>> server, licensing, phones, an internet connection, etc. it's apart of the
>>> solution
>>> 3. sign it yourself with any ca you want to include the one running on
>>> your home computer, and just don't tell anyone what you did because you
>>> setup it for
>>> 34 years and it wont matter by then anyway (ok, just kidding here...or
>>> am I?)
>>>
>>> On Fri, Apr 17, 2020 at 3:55 PM Bill Talley <btalley@gmail.com> wrote:
>>>
>>>> Great info Anthony, thanks.
>>>>
>>>> Question, what do you do for Expressway Core if you don’t have an
>>>> internal CA to sign the EXPC (meaning no internal root cert to upload to
>>>> EXPE to establish the traversal zone trust)?
>>>>
>>>> Sent from an iPhone mobile device with very tiny touchscreen input
>>>> keys. Please excude my typtos.
>>>>
>>>> On Apr 17, 2020, at 3:25 PM, Anthony Holloway <
>>>> avholloway+cisco-voip@gmail.com> wrote:
>>>>
>>>> ?
>>>> This might be an unpopular opinion, but I think using the free certs
>>>> provided by let's encrypt, coupled with it being automatic from now on,
>>>> it's just an unbeatable combination.
>>>>
>>>> Here are my cliff notes:
>>>>
>>>> Reference Document:
>>>>
>>>>
>>>> https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/exwy_b_certificate-creation-use-deployment-guide/exwy_b_certificate-creation-use-deployment-guide_chapter_0100.html
>>>>
>>>>
>>>>
>>>> High Level Steps:
>>>>
>>>> 1. Expressway 12.5.7 to avoid ACMEv1 vs ACMEv2 registration issues (
>>>> https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346)
>>>> 2. For your Unified CM registrations domains don’t use parent
>>>> domain only (E.g., company.com), switch to CollabEdgeDNS format
>>>> instead (E.g., collab-edge.company.com), because you’ll need that
>>>> in the next step
>>>> 3. DNS A records for the Expressway-E FQDN and the CM registration
>>>> domains
>>>> 4. Upload the root and intermediates for Let’s Encrypt (needed on
>>>> both Expressway-E and Expressway-C) (certs are linked in documentation)
>>>> 5. Enable the ACME client on Expressway-E and supply any email
>>>> address you want to link to this registration (This creates your account
>>>> with Let’s Encrypt)
>>>> 6. Generate a new CSR (Server Certificate Only, Domain Cert Was Not
>>>> Needed)
>>>> 7. Click button to Submit CSR to ACME
>>>> 8. Click button to Deploy New Certificate on Expressway-E
>>>> (documentation states this is non-service impacting)
>>>> 9. Setup the automatic scheduler so you never have to deal with
>>>> this again
>>>> 10. Sit back, relax and enjoy free shit
>>>>
>>>>
>>>>
>>>>
>>>> On Fri, Apr 17, 2020 at 1:43 PM Riley, Sean <
>>>> SRiley@robinsonbradshaw.com> wrote:
>>>>
>>>>> We had our Cisco partner setup our Expressways a couple of years ago.
>>>>> It is a cluster with 2 E’s and 2 C’s currently at v 12.5.7 using for MRA.
>>>>> I have been managing them, installing updates, troubleshooting etc. The
>>>>> public Edge cert is up for renewal. Can anyone provide advice on renewing
>>>>> this cert? I am planning on just renewing with the same cert provider, but
>>>>> was interested in if there is anything to watch out for. Example, will
>>>>> there be a service interruption when replacing the cert? Or just install
>>>>> the new cert/pk and rest easy?
>>>>>
>>>>>
>>>>>
>>>>> Thanks in advance.
>>>>>
>>>>>
>>>>>
>>>>> Sean.
>>>>> _______________________________________________
>>>>> cisco-voip mailing list
>>>>> cisco-voip@puck.nether.net
>>>>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>>>>
>>>> _______________________________________________
>>>> cisco-voip mailing list
>>>> cisco-voip@puck.nether.net
>>>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>>>
>>>> _______________________________________________
>>> cisco-voip mailing list
>>> cisco-voip@puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>>
>>

The one year cert ones into play later this year and only for certs issues after a certain date, October I think.

I’d go with two year certs if I was doing now. Which we will be soon.

Heck, I’d be renewing certs before their expiry date as much as possible to buy another year.

I’m hoping a SP for v11.5 comes out that supports let’s encrypt. But I doubt it.

Sent from my iPhone

On Apr 17, 2020, at 7:04 PM, Charles Goldsmith <w@woka.us> wrote:

?
Very true on the service interruption, but how about jabber, new certs on it require the XMPP services to restart. And true, a satellite server could alleviate it all, but you are talking major changes for the CUCM team, and then the CUC team, etc.

I'd love for it to happen, but we have some hurdles, and I'm sure this has been discussed amongst the developers and the BUs.

With Apple changing and advising certs for 1 year, I had a bigger customer just tell me that they are adopting 1 year certs as the standard. I'm about to renew their entire cluster of 18 nodes (across all of the apps) for their certs, and they will be 1 year certs.

For a 24/7 operation, that's a pain, but, more work for us I guess.


On Fri, Apr 17, 2020 at 5:36 PM Anthony Holloway <avholloway+cisco-voip@gmail.com<mailto:avholloway%2Bcisco-voip@gmail.com>> wrote:
You Charles, with smart licensing being a catalyst for internet access for your apps, and the way the port 80 thing for ACME actually works, it's certainly possible, and I could see it gaining adoption with SMB....maybe not the fortune 500 though. But then again, they can just spend the money on public certs.

And also, you mentioned the challenge of updating certs every 90 days and the service restarts, however, with the way Expressway implemented it, the renewals are automatic and there is no service interruption at all.

On Fri, Apr 17, 2020 at 4:50 PM Charles Goldsmith <w@woka.us<mailto:w@woka.us>> wrote:
Early on with MRA, back in the CUCM 9.1 days, a mobile user coming in across MRA got cert alerts if you didn't have signed certs on all of the applications (CUCM, IM&P, Unity Connection). There was/is no easy way to push an internal CA cert to those devices.

That's the whole reason we push for 3rd party everywhere, so that the C level folks on their smart phones didn't get an alert.

I'd really like to see let's encrypt enabled on all of the apps, but that is challenging, updating certs every 90 days, restarting services, etc. Plus, the whole thing of the Acme process needing to be available into the application to validate.

On Fri, Apr 17, 2020 at 4:27 PM Anthony Holloway <avholloway+cisco-voip@gmail.com<mailto:avholloway%2Bcisco-voip@gmail.com>> wrote:
Well, that depends. And let me just ask, why did they do it this way? If it was even a self-signed cert, we could atleast import it to E, but it's not even that. It's some invalid bogus cert in there. Why?

I have seen the following:

1. publicly sign it (name cheap has dirt cheap certs)
2. get a private ca installed because just like you need a network, a server, licensing, phones, an internet connection, etc. it's apart of the solution
3. sign it yourself with any ca you want to include the one running on your home computer, and just don't tell anyone what you did because you setup it for
34 years and it wont matter by then anyway (ok, just kidding here...or am I?)

On Fri, Apr 17, 2020 at 3:55 PM Bill Talley <btalley@gmail.com<mailto:btalley@gmail.com>> wrote:
Great info Anthony, thanks.

Question, what do you do for Expressway Core if you don’t have an internal CA to sign the EXPC (meaning no internal root cert to upload to EXPE to establish the traversal zone trust)?

Sent from an iPhone mobile device with very tiny touchscreen input keys. Please excude my typtos.

On Apr 17, 2020, at 3:25 PM, Anthony Holloway <avholloway+cisco-voip@gmail.com<mailto:avholloway%2Bcisco-voip@gmail.com>> wrote:

?
This might be an unpopular opinion, but I think using the free certs provided by let's encrypt, coupled with it being automatic from now on, it's just an unbeatable combination.

Here are my cliff notes:

Reference Document:
https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/exwy_b_certificate-creation-use-deployment-guide/exwy_b_certificate-creation-use-deployment-guide_chapter_0100.html

High Level Steps:

1. Expressway 12.5.7 to avoid ACMEv1 vs ACMEv2 registration issues (https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346)
2. For your Unified CM registrations domains don’t use parent domain only (E.g., company.com<http://company.com>), switch to CollabEdgeDNS format instead (E.g., collab-edge.company.com<http://collab-edge.company.com>), because you’ll need that in the next step
3. DNS A records for the Expressway-E FQDN and the CM registration domains
4. Upload the root and intermediates for Let’s Encrypt (needed on both Expressway-E and Expressway-C) (certs are linked in documentation)
5. Enable the ACME client on Expressway-E and supply any email address you want to link to this registration (This creates your account with Let’s Encrypt)
6. Generate a new CSR (Server Certificate Only, Domain Cert Was Not Needed)
7. Click button to Submit CSR to ACME
8. Click button to Deploy New Certificate on Expressway-E (documentation states this is non-service impacting)
9. Setup the automatic scheduler so you never have to deal with this again
10. Sit back, relax and enjoy free shit



On Fri, Apr 17, 2020 at 1:43 PM Riley, Sean <SRiley@robinsonbradshaw.com<mailto:SRiley@robinsonbradshaw.com>> wrote:
We had our Cisco partner setup our Expressways a couple of years ago. It is a cluster with 2 E’s and 2 C’s currently at v 12.5.7 using for MRA. I have been managing them, installing updates, troubleshooting etc. The public Edge cert is up for renewal. Can anyone provide advice on renewing this cert? I am planning on just renewing with the same cert provider, but was interested in if there is anything to watch out for. Example, will there be a service interruption when replacing the cert? Or just install the new cert/pk and rest easy?

Thanks in advance.

Sean.
_______________________________________________
cisco-voip mailing list
cisco-voip@puck.nether.net<mailto:cisco-voip@puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip
_______________________________________________
cisco-voip mailing list
cisco-voip@puck.nether.net<mailto:cisco-voip@puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip
_______________________________________________
cisco-voip mailing list
cisco-voip@puck.nether.net<mailto:cisco-voip@puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip
_______________________________________________
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Thanks for the reply and cliffs notes about the setup. My security team has concerns with having port 80 open to facility the Let’s Encrypt process. Documentation states something about allowing the built in protections without giving much info on what those protections are.

I would love to be able to set it and forget it.

From: Anthony Holloway <avholloway+cisco-voip@gmail.com>
Sent: Friday, April 17, 2020 4:23 PM
To: Riley, Sean <SRiley@robinsonbradshaw.com>
Cc: cisco-voip@puck.nether.net
Subject: Re: [cisco-voip] Renewing Expressway E Cert

WARNING: External Email
________________________________
This might be an unpopular opinion, but I think using the free certs provided by let's encrypt, coupled with it being automatic from now on, it's just an unbeatable combination.

Here are my cliff notes:

Reference Document:
https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/exwy_b_certificate-creation-use-deployment-guide/exwy_b_certificate-creation-use-deployment-guide_chapter_0100.html

High Level Steps:

1. Expressway 12.5.7 to avoid ACMEv1 vs ACMEv2 registration issues (https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346)
2. For your Unified CM registrations domains don’t use parent domain only (E.g., company.com<http://company.com>), switch to CollabEdgeDNS format instead (E.g., collab-edge.company.com<http://collab-edge.company.com>), because you’ll need that in the next step
3. DNS A records for the Expressway-E FQDN and the CM registration domains
4. Upload the root and intermediates for Let’s Encrypt (needed on both Expressway-E and Expressway-C) (certs are linked in documentation)
5. Enable the ACME client on Expressway-E and supply any email address you want to link to this registration (This creates your account with Let’s Encrypt)
6. Generate a new CSR (Server Certificate Only, Domain Cert Was Not Needed)
7. Click button to Submit CSR to ACME
8. Click button to Deploy New Certificate on Expressway-E (documentation states this is non-service impacting)
9. Setup the automatic scheduler so you never have to deal with this again
10. Sit back, relax and enjoy free shit



On Fri, Apr 17, 2020 at 1:43 PM Riley, Sean <SRiley@robinsonbradshaw.com<mailto:SRiley@robinsonbradshaw.com>> wrote:
We had our Cisco partner setup our Expressways a couple of years ago. It is a cluster with 2 E’s and 2 C’s currently at v 12.5.7 using for MRA. I have been managing them, installing updates, troubleshooting etc. The public Edge cert is up for renewal. Can anyone provide advice on renewing this cert? I am planning on just renewing with the same cert provider, but was interested in if there is anything to watch out for. Example, will there be a service interruption when replacing the cert? Or just install the new cert/pk and rest easy?

Thanks in advance.

Sean.
_______________________________________________
cisco-voip mailing list
cisco-voip@puck.nether.net<mailto:cisco-voip@puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip

First and foremost, the document describes how port 80 is used
pretty well. It goes on to say that its no less secure than port 443,
because the same underlying program/process answers to both, thus is
susceptible to the same attacks.

People think it's less secure because it's clear text communication, but
that's not pertinent to how people attack a host. It is however, how you
intercept communications, and then use that information to your advantage.

However, the document also describes how port 80 is auto redirecting all
traffic to 443 by default, until the renewal process starts, which is at a
random/unpredictable time, and is only changed to redirect port 80 traffic
to 443 for a very specific GET Request to a very specific URL. In which
case, the port 80 traffic is then redirected to another separate web server
instance which is spun up just in this moment to handle the comms with
let's encrypt, and as soon as it's done, the web server instance is turned
off, and all port 80 traffic is again redirected to 443.

So, the security of the system is actually pretty tight. Is it 100%?
probably not. But then again, what truly is 100% secure?

On Wed, Apr 22, 2020 at 3:42 PM Riley, Sean <SRiley@robinsonbradshaw.com>
wrote:

> Thanks for the reply and cliffs notes about the setup. My security team
> has concerns with having port 80 open to facility the Let’s Encrypt
> process. Documentation states something about allowing the built in
> protections without giving much info on what those protections are.
>
>
>
> I would love to be able to set it and forget it.
>
>
>
> *From:* Anthony Holloway <avholloway+cisco-voip@gmail.com>
> *Sent:* Friday, April 17, 2020 4:23 PM
> *To:* Riley, Sean <SRiley@robinsonbradshaw.com>
> *Cc:* cisco-voip@puck.nether.net
> *Subject:* Re: [cisco-voip] Renewing Expressway E Cert
>
>
>
> *WARNING: **External Email *
> ------------------------------
>
> This might be an unpopular opinion, but I think using the free certs
> provided by let's encrypt, coupled with it being automatic from now on,
> it's just an unbeatable combination.
>
>
>
> Here are my cliff notes:
>
>
>
> Reference Document:
>
>
> https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/exwy_b_certificate-creation-use-deployment-guide/exwy_b_certificate-creation-use-deployment-guide_chapter_0100.html
>
>
>
> High Level Steps:
>
> 1. Expressway 12.5.7 to avoid ACMEv1 vs ACMEv2 registration issues (
> https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346)
> 2. For your Unified CM registrations domains don’t use parent domain
> only (E.g., company.com), switch to CollabEdgeDNS format instead
> (E.g., collab-edge.company.com), because you’ll need that in the next
> step
> 3. DNS A records for the Expressway-E FQDN and the CM registration
> domains
> 4. Upload the root and intermediates for Let’s Encrypt (needed on both
> Expressway-E and Expressway-C) (certs are linked in documentation)
> 5. Enable the ACME client on Expressway-E and supply any email address
> you want to link to this registration (This creates your account with Let’s
> Encrypt)
> 6. Generate a new CSR (Server Certificate Only, Domain Cert Was Not
> Needed)
> 7. Click button to Submit CSR to ACME
> 8. Click button to Deploy New Certificate on Expressway-E
> (documentation states this is non-service impacting)
> 9. Setup the automatic scheduler so you never have to deal with this
> again
> 10. Sit back, relax and enjoy free shit
>
>
>
>
>
>
>
> On Fri, Apr 17, 2020 at 1:43 PM Riley, Sean <SRiley@robinsonbradshaw.com>
> wrote:
>
> We had our Cisco partner setup our Expressways a couple of years ago. It
> is a cluster with 2 E’s and 2 C’s currently at v 12.5.7 using for MRA. I
> have been managing them, installing updates, troubleshooting etc. The
> public Edge cert is up for renewal. Can anyone provide advice on renewing
> this cert? I am planning on just renewing with the same cert provider, but
> was interested in if there is anything to watch out for. Example, will
> there be a service interruption when replacing the cert? Or just install
> the new cert/pk and rest easy?
>
>
>
> Thanks in advance.
>
>
>
> Sean.
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>
>

I think I could have written a piece of that better....

"...which is at a random/unpredictable time, where it will not for port 80
traffic to port 443 for a very specific GET Request to a very specific URL."

I think that's better. Anyway, I read it in the documentation, so if
what I wrote is confusing, just read the docs. 1:00am email replies.
sheesh!

On Thu, Apr 23, 2020 at 1:13 AM Anthony Holloway <
avholloway+cisco-voip@gmail.com> wrote:

> First and foremost, the document describes how port 80 is used
> pretty well. It goes on to say that its no less secure than port 443,
> because the same underlying program/process answers to both, thus is
> susceptible to the same attacks.
>
> People think it's less secure because it's clear text communication, but
> that's not pertinent to how people attack a host. It is however, how you
> intercept communications, and then use that information to your advantage.
>
> However, the document also describes how port 80 is auto redirecting all
> traffic to 443 by default, until the renewal process starts, which is at a
> random/unpredictable time, and is only changed to redirect port 80 traffic
> to 443 for a very specific GET Request to a very specific URL. In which
> case, the port 80 traffic is then redirected to another separate web server
> instance which is spun up just in this moment to handle the comms with
> let's encrypt, and as soon as it's done, the web server instance is turned
> off, and all port 80 traffic is again redirected to 443.
>
> So, the security of the system is actually pretty tight. Is it 100%?
> probably not. But then again, what truly is 100% secure?
>
> On Wed, Apr 22, 2020 at 3:42 PM Riley, Sean <SRiley@robinsonbradshaw.com>
> wrote:
>
>> Thanks for the reply and cliffs notes about the setup. My security team
>> has concerns with having port 80 open to facility the Let’s Encrypt
>> process. Documentation states something about allowing the built in
>> protections without giving much info on what those protections are.
>>
>>
>>
>> I would love to be able to set it and forget it.
>>
>>
>>
>> *From:* Anthony Holloway <avholloway+cisco-voip@gmail.com>
>> *Sent:* Friday, April 17, 2020 4:23 PM
>> *To:* Riley, Sean <SRiley@robinsonbradshaw.com>
>> *Cc:* cisco-voip@puck.nether.net
>> *Subject:* Re: [cisco-voip] Renewing Expressway E Cert
>>
>>
>>
>> *WARNING: **External Email *
>> ------------------------------
>>
>> This might be an unpopular opinion, but I think using the free certs
>> provided by let's encrypt, coupled with it being automatic from now on,
>> it's just an unbeatable combination.
>>
>>
>>
>> Here are my cliff notes:
>>
>>
>>
>> Reference Document:
>>
>>
>> https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/exwy_b_certificate-creation-use-deployment-guide/exwy_b_certificate-creation-use-deployment-guide_chapter_0100.html
>>
>>
>>
>> High Level Steps:
>>
>> 1. Expressway 12.5.7 to avoid ACMEv1 vs ACMEv2 registration issues (
>> https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346)
>> 2. For your Unified CM registrations domains don’t use parent domain
>> only (E.g., company.com), switch to CollabEdgeDNS format instead
>> (E.g., collab-edge.company.com), because you’ll need that in the next
>> step
>> 3. DNS A records for the Expressway-E FQDN and the CM registration
>> domains
>> 4. Upload the root and intermediates for Let’s Encrypt (needed on
>> both Expressway-E and Expressway-C) (certs are linked in documentation)
>> 5. Enable the ACME client on Expressway-E and supply any email
>> address you want to link to this registration (This creates your account
>> with Let’s Encrypt)
>> 6. Generate a new CSR (Server Certificate Only, Domain Cert Was Not
>> Needed)
>> 7. Click button to Submit CSR to ACME
>> 8. Click button to Deploy New Certificate on Expressway-E
>> (documentation states this is non-service impacting)
>> 9. Setup the automatic scheduler so you never have to deal with this
>> again
>> 10. Sit back, relax and enjoy free shit
>>
>>
>>
>>
>>
>>
>>
>> On Fri, Apr 17, 2020 at 1:43 PM Riley, Sean <SRiley@robinsonbradshaw.com>
>> wrote:
>>
>> We had our Cisco partner setup our Expressways a couple of years ago. It
>> is a cluster with 2 E’s and 2 C’s currently at v 12.5.7 using for MRA. I
>> have been managing them, installing updates, troubleshooting etc. The
>> public Edge cert is up for renewal. Can anyone provide advice on renewing
>> this cert? I am planning on just renewing with the same cert provider, but
>> was interested in if there is anything to watch out for. Example, will
>> there be a service interruption when replacing the cert? Or just install
>> the new cert/pk and rest easy?
>>
>>
>>
>> Thanks in advance.
>>
>>
>>
>> Sean.
>>
>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voip@puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>
>>

I really do appreciate your responses. Especially since I could have RTFM.

From: Anthony Holloway <avholloway+cisco-voip@gmail.com>
Sent: Thursday, April 23, 2020 2:16 AM
To: Riley, Sean <SRiley@robinsonbradshaw.com>
Cc: cisco-voip@puck.nether.net
Subject: Re: [cisco-voip] Renewing Expressway E Cert

WARNING: External Email
________________________________
I think I could have written a piece of that better....

"...which is at a random/unpredictable time, where it will not for port 80 traffic to port 443 for a very specific GET Request to a very specific URL."

I think that's better. Anyway, I read it in the documentation, so if what I wrote is confusing, just read the docs. 1:00am email replies. sheesh!

On Thu, Apr 23, 2020 at 1:13 AM Anthony Holloway <avholloway+cisco-voip@gmail.com<mailto:avholloway%2Bcisco-voip@gmail.com>> wrote:
First and foremost, the document describes how port 80 is used pretty well. It goes on to say that its no less secure than port 443, because the same underlying program/process answers to both, thus is susceptible to the same attacks.

People think it's less secure because it's clear text communication, but that's not pertinent to how people attack a host. It is however, how you intercept communications, and then use that information to your advantage.

However, the document also describes how port 80 is auto redirecting all traffic to 443 by default, until the renewal process starts, which is at a random/unpredictable time, and is only changed to redirect port 80 traffic to 443 for a very specific GET Request to a very specific URL. In which case, the port 80 traffic is then redirected to another separate web server instance which is spun up just in this moment to handle the comms with let's encrypt, and as soon as it's done, the web server instance is turned off, and all port 80 traffic is again redirected to 443.

So, the security of the system is actually pretty tight. Is it 100%? probably not. But then again, what truly is 100% secure?

On Wed, Apr 22, 2020 at 3:42 PM Riley, Sean <SRiley@robinsonbradshaw.com<mailto:SRiley@robinsonbradshaw.com>> wrote:
Thanks for the reply and cliffs notes about the setup. My security team has concerns with having port 80 open to facility the Let’s Encrypt process. Documentation states something about allowing the built in protections without giving much info on what those protections are.

I would love to be able to set it and forget it.

From: Anthony Holloway <avholloway+cisco-voip@gmail.com<mailto:avholloway%2Bcisco-voip@gmail.com>>
Sent: Friday, April 17, 2020 4:23 PM
To: Riley, Sean <SRiley@robinsonbradshaw.com<mailto:SRiley@robinsonbradshaw.com>>
Cc: cisco-voip@puck.nether.net<mailto:cisco-voip@puck.nether.net>
Subject: Re: [cisco-voip] Renewing Expressway E Cert

WARNING: External Email
________________________________
This might be an unpopular opinion, but I think using the free certs provided by let's encrypt, coupled with it being automatic from now on, it's just an unbeatable combination.

Here are my cliff notes:

Reference Document:
https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/exwy_b_certificate-creation-use-deployment-guide/exwy_b_certificate-creation-use-deployment-guide_chapter_0100.html

High Level Steps:

1. Expressway 12.5.7 to avoid ACMEv1 vs ACMEv2 registration issues (https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82346)
2. For your Unified CM registrations domains don’t use parent domain only (E.g., company.com<http://company.com>), switch to CollabEdgeDNS format instead (E.g., collab-edge.company.com<http://collab-edge.company.com>), because you’ll need that in the next step
3. DNS A records for the Expressway-E FQDN and the CM registration domains
4. Upload the root and intermediates for Let’s Encrypt (needed on both Expressway-E and Expressway-C) (certs are linked in documentation)
5. Enable the ACME client on Expressway-E and supply any email address you want to link to this registration (This creates your account with Let’s Encrypt)
6. Generate a new CSR (Server Certificate Only, Domain Cert Was Not Needed)
7. Click button to Submit CSR to ACME
8. Click button to Deploy New Certificate on Expressway-E (documentation states this is non-service impacting)
9. Setup the automatic scheduler so you never have to deal with this again
10. Sit back, relax and enjoy free shit



On Fri, Apr 17, 2020 at 1:43 PM Riley, Sean <SRiley@robinsonbradshaw.com<mailto:SRiley@robinsonbradshaw.com>> wrote:
We had our Cisco partner setup our Expressways a couple of years ago. It is a cluster with 2 E’s and 2 C’s currently at v 12.5.7 using for MRA. I have been managing them, installing updates, troubleshooting etc. The public Edge cert is up for renewal. Can anyone provide advice on renewing this cert? I am planning on just renewing with the same cert provider, but was interested in if there is anything to watch out for. Example, will there be a service interruption when replacing the cert? Or just install the new cert/pk and rest easy?

Thanks in advance.

Sean.
_______________________________________________
cisco-voip mailing list
cisco-voip@puck.nether.net<mailto:cisco-voip@puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip